Methods for Assessing the Effectiveness of Information Security Systems in Distributed Information Systems

Abstract

The article considers methods and approaches to assessing the effectiveness of information security systems in distributed information systems, in particular, a mathematical model for determining the current effectiveness of such systems is derived. The model is based on the calculation of protection potentials, the level of equipment of system elements with security features, and the efficiency of management processes. The article decomposes the main types of threats - theft, copying, disclosure, blocking, modification and destruction of information. To determine the probability of attacks, Bayesian inference and hierarchical analysis (MHA) methods are used to obtain quantitative risk indicators for each category of threat. A new approach to assessing the level of losses arising from the amount of resources required to localize the consequences of attacks is developed. A methodology for modelling the impact of threats using a matrix of pairwise comparisons is proposed, which allows optimising the cost of security measures without increasing the overall cost by replacing expensive methods with alternative more efficient approaches. Particular attention is paid to insider threats, which both attack models and analysis of real incidents confirm. The practical application of the proposed models allows one to increase the efficiency of protection, reduce the cost of system maintenance and ensure its flexibility in responding to constantly changing cyber threats.