Author Email: molotov.linar@mail.ru
Abstract
The article solves the problem of assessing security risks in information systems using the methods of the theory of fuzzy sets. The urgency of solving this problem is determined by the complexity of applying a number of existing methods, the possible inaccuracy of quantitative assessments of risk factors, and the possible inadequacy, uncertainty and quality of the initial information. The paper carries out formalization of the subject area “Information Security Risk” in the form of a conceptual model within the framework of the types of ER diagram, and determines the semantics of its concepts within the framework of the theory of categories and factors. The developed methods for assessing information security risks and evaluating the effectiveness of countermeasures are capable of solving problems in the indicated conditions. We have conducted the experiments on the application of the technique on a specific object of protection. The set of countermeasures recommended for implementation shows high efficiency in terms of absolute risk reduction. Recommendations on the choice of forms of membership functions of fuzzy scales used in risk assessment, as well as recommendations on the choice of fuzzy operations when performing calculations are given. The practical application of the developed methodology has a high practical value for building effective information protection systems in terms of expected damage.
Introduction
The modern stage of development of society is characterized by significant changes under the influence of modern information technologies. Currently, intensive research is being conducted in which the attempts to formulate the peculiarities of the impact of Internet technologies, in particular, on the economy are being made. The digital economics is rapidly replacing the old way of life in almost all spheres of human activity. The expansion of large volume of data, the development of data processing technologies and the tightening of requirements for modern information systems (IS) require their development in many areas. Note the relevance of the task of integration of the IS of organizations with e-commerce systems of various classes [1]. The IS accepted in the process of development should be consistent with the strategy of development of the organization and progress in those areas of informatization methods that play the most important role in the composition of the system. Moreover, decisions often have to be made under the conditions of considerable information uncertainty. Under these conditions, an increase in the level of rationality of the decisions made can be achieved using the methods based on a set-fuzzy approach [2,3].
Conclusion
Risk assessment of information security of IS is an urgent task and requires the development of formal approaches to its solution. This article formalized “Risk B <” subject area as a conceptual model within the types of ER-diagram, and also defined the semantics of its concepts within the framework of the theory of categories and functors. The developed methodology for assessing the risks of data security and evaluating the effectiveness of countermeasures is capable of solving the problems in the context of fuzziness of the initial information. Experiments on the application of the developed methods on a specific object of protection were carried out. At the same time, the set of countermeasures recommended for implementation showed high efficiency in terms of absolute risk reduction. Recommendations on the choice of forms of the membership functions of fuzzy scales used in the risk assessment, as well as on the choice of fuzzy operations when performing calculations, were given. The practical application of the developed methodology has a high practical value for building effective systems of information protection in terms of expected damage.
1,674 total views, no views today