-Information security risk management as important process of data protection in automated systems has been presented. Such criteria as estimates consistency and adequacy, adaptability to qualitative data, assessment subjectivity and uncertainty, risk sensitivity, which influence risk management effectiveness, have been identified. A task of integrated methodology development has been formalized in accordance with presented criteria. A structural model of comprehensive methodology, which displays its components and relationships between them, has been designed as a flowchart. A method for drawing up the risk factors list, including information security threats, potentially possible damage, automated system vulnerabilities, based on IDEF0 modeling, has been proposed. An original expert survey method, which provides compliance with the requirements of consistency and adequacy maximization for risk factors assessment, has been suggested. A neuro-fuzzy network based on Takagi-Sugeno-Kang model for information security risk calculation from risk factors assessment has been developed in MATLAB. A countermeasures choice method based on game theory criteria has been illustrated.
INTRODUCTION
Reliability of functioning of automated systems mostly
depends on ensuring their information security. Therefore,
based on the specifics of automated systems, companies
develop and implement a corresponding set of activities to
manage information security. An important component of this
process is information security risk management (e.g. [
Information security risk management consists of: drawing up the risk factors list (information security threats, potentially possible damage, automated system vulnerabilities); expert survey for risk factors assessment; risk level calculation, based on risk factors estimates; choice of the countermeasures for reducing the risk to acceptable level.
Each stage of information security risk management must
be realized by different methods and tools, which are the most
effective for this particular stage. So, the main research
direction in the field of information security risk management
should be focused on the selection of such methods, which
maximally satisfy the needs of different stages of the process
[
Investigation of qualitative, quantitative and
semiqualitative information security risk management methods,
such as hazard and operability study (HAZOP) [
The set of requirements to effectiveness criteria for a comprehensive information security risk management methodology is as in (1) and (2) a(yk) × b(yk) × c(yk) → max d(yk) × e(yk) → min
Practical investigation allows to develop a comprehensive information security risk management methodology based on presented set of effectiveness criteria (Fig. 1).
feedbacks.
Based on the characteristics of information security risk management, it is necessary to have risk factors in the IDEF0model according to a set of principles (Fig. 2).
DRAWING UP THE RISK FACTORS LIST USING IDEF0
The initial stage of information security risk management is
the identification of risk factors (threats, possible damage,
vulnerabilities) [
When countermeasures are choosing and adding to the
IDEF0 model, it is necessary understand that their list is
preliminary, as the identified risk factors have not been
evaluated yet by the expert group. Therefore, it is impossible to
make an unambiguous conclusion about the degree of their
impact on found threats and vulnerabilities. After risk factors
assessment and subsequently calculating the level of risk, when
all quantities acquire numerical values, the list of
countermeasures can be adjusted [
EXPERT SURVEY FOR RISK FACTORS ASSESSMENT
To ensure the consistency and adequacy of expert opinions in assessment of risk factors from the list compiled with the IDEF0 model, a special method of expert interview has been developed. Assessment of threats, potentially possible damage and vulnerabilities must be performed by the expert group in accordance with (3), (4) and (5): xij1 = kij1 × pij1 × fij1 xij2 = kij2 × pij2 × fij2 xij3 = kij3 × pij3 × fij3 xij1 – threat estimate; kij1 ϵ [0; 10] – threat power; pij1 ϵ [0; 1] – probability of threat realization; fij1 ϵ [0; 1] – risk sensitivity to threat assessment; xij2 – potentially possible damage estimate; kij2 ϵ [0; 10] – asset value; pij2 ϵ [0; 1] – probability of the highest damage; fij2 ϵ [0; 1] – risk sensitivity to damage assessment; xij3 – vulnerability estimate; kij3 ϵ [0; 10] – vulnerability degree; pij3 ϵ [0; 1] – probability of vulnerability exploit; fij3 ϵ [0; 1] – risk sensitivity to vulnerability assessment; i = {1, 2, ..., m} – experts; j = {1, 2, ..., n} – risk factors from the list.
The consistency (a(yk)) of estimates is provided by calculating the concordance coefficient W using (6), (7), (8), (9):
xj = ∑xij x = 1/n × ∑xij
S = ∑(xj - x)2
W = 12S/(m2(n3 - n))
Then it is necessary to screen out extreme scores using an algorithm based on the verbal-numeric Margolin and Harrington scales (Fig. 1). The adequacy (b(yk)) of overall threat (x1), potentially possible damage (x2) and vulnerability (x3) estimates is provided by maximization of the objective function (10):
F(x) = x1 + x2 + x3 → max
It is necessary to construct a linear constraint system of inequalities (11) containing the number of remaining estimates of threats (ai1), potentially possible damage (ai2) and vulnerabilities (ai3) for each expert, and the sum of each expert estimates (bi): ai1 × x1 + ai2 × x2 + ai3 × x3 ≤ bi
The linear constraint system of inequalities reduces to the
optimization problem of linear programming and can be solved
using the simplex method [
IV.
NEURO-FUZZY NETWORK FOR RISK LEVEL ASSESSMENT It is necessary to use a method that is adaptive to qualitative data (c(yk)), minimizes subjectivity (d(yk)) and uncertainty (e(yk)) of estimates and takes into account risk sensitivity to various factors (f).
A comparative analysis of the approaches, based on
machine learning [
The results of the comparative analysis show that neurofuzzy networks have the best effectiveness criteria values.
Therefore, a neuro-fuzzy network is chosen as a risk assessment tool, which calculates risk level using three input risk factors values received in the previous stage.
The realized neuro-fuzzy network is transformed from Takagi-Sugeno-Kang fuzzy model and contains five layers: fuzzification, aggregation, activation, accumulation, defuzzification (Fig. 3).
Characteristics of the neuro-fuzzy network: structure – five-layered neuro-fuzzy network: fuzzy model type – Takagi-Sugeno-Kang; three input variables – threat, damage, vulnerability; five fuzzy sets for input variables – very low, low, medium, high, very high; trapezoidal membership function for input variables (Fig. 4); one output variable – information security risk level; nine values for output variable – negligibly low (0), very low (0,125), low (0,25), below average (0,375); average (0,5), above average (0,625), high (0,75), very high (0,875), critical (1); conjunction – algebraic product method; disjunction – algebraic sum method; defuzzification – weighted average method.
A verbal-numerical risk assessment scale, based on nine initially specified values of the output variable, has been developed. The scale allows to interpret the risk level obtained at the output in the form of a numerical index (Table II).
If the neuro-fuzzy network shows that the risk level is unacceptable, it is necessary to select the appropriate countermeasures to reduce it.
Risk level Negligibly low (0) Very low (0,125)
Low (0,25) Below average
(0,375) Average (0,5) Above average
(0,625)
High (0,75) Very high (0,875)
Critical (1)
Description
Risk can be neglected If the information is regarded as a very low risk, it is necessary to determine whether there is a need for corrective actions, or there is a possibility to take this risk The risk level allows to work, but there are prerequisites for a malfunction It is necessary to develop and apply a corrective action plan within an acceptable period of time The risk level does not allow to work stably, there is an urgent need for corrective actions that change the mode of work towards reducing the risk The system can continue to work, but the corrective action plan must be applied as quickly as possible The risk level is such that business processes are in an unstable state It is necessary to take measures to reduce the risk immediately The risk level is very high and unacceptable for the organization, which requires discontinuing the system operation and taking radical measures to reduce the risk
The developed method of the countermeasures choice is
based on the above expert survey method, but uses the game
theory criteria for searching the optimal economic strategy.
There are three possible criteria – Wald’s maximin model,
Hurwicz criteria and Minimax regret [
Wald’s maximin model is aimed at minimizing the loss or guaranteed minimal result. The minimal impact of each countermeasure on any risk factor is determined, after that the countermeasure with the maximal smallest influence is chosen. It is the lower price of the game.
Hurwicz criteria is based on the choice of the pessimism indicator in the range from 0 to 1. If the pessimism indicator is maximal (equal to 1), Hurwicz criteria corresponds to Wald’s maximin model, realizing a pessimistic strategy. The minimal pessimism indicator (equal to 0) should not be chosen, because the optimistic strategy is focused on maximizing the project's result, so the risk associated with unfavorable development of the external environment is not taken into account. Hurwicz criteria is the most flexible of all methods of the game theory, because it allows to compare several optimistic and pessimistic scenarios. The disadvantage is the subjectivity of the pessimism indicator choice by the researcher or the person making the decision.
Minimax regret is based on a matrix of regrets, made up of a matrix of strategies. Regrets are a lost result with a suboptimal strategy for each current state of the automated system. At first the maximal impact on each risk factor among all countermeasures is determined. Further, lost results of all countermeasures are calculated, then the regression matrix is compiled, where the maximal ineffective result of each countermeasure is determined. The countermeasure with the smallest maximal lost result is selected.
Each expert should complete two copies of the matrix of strategies (Table III) – for active countermeasures impact (cija) that reduces threats and damage, and for passive countermeasures impact (cijp) that reduces vulnerabilities and damage.
...
am = vm There are: b1 c11 c21 ... cm1 b2 c12 c22 ... cm2 ... ... ... ... ...
bn c1n c2n ... cmn ai – countermeasures; bj – risk factors; cij – impact of countermeasure on risk factor; vi – cost of countermeasure;
After choosing a countermeasure in accordance with any of three criteria, depending on the economic strategy, the corresponding line is removed from the strategy matrix, after that it is necessary to conduct a new cycle. Countermeasures among the remaining are selected until their total value does not exceed the amount of potential damage (12): ∑v ≤ vd where: ∑v – total cost of selected countermeasures; vd – cost of potentially possible damage (budget for the countermeasures implementation).
Each expert needs to subtract his estimates of the countermeasures impact (cija, cijp) on risk factors from his earlier estimates (xij1, xij2, xij3) as (13), (14) and (15): x*ij1 = xij1 - cija x*ij2 = xij2 - cija - cijp x*ij3 = xij3 - cijp
Finally, the neuro-fuzzy network calculates the residual risk level after the countermeasures implementation.
VI.
CONCLUSION
The developed comprehensive information security risk management methodology meets the required effectiveness criteria, has a complex and branched structure and represents a set of methods and models used to implement various stages of management. The methodology is based on the joint use and interaction of IDEF0 model, expert survey, neuro-fuzzy network, methods of game theory and allows the most effective implementation of drawing up risk factors list, risk factors assessment, risk level calculation and countermeasures choice.