The paper considers the actual task of making managerial decisions by the Chief Information Security Officer. The need for the optimal distribution of tasks between department officers is shown. This problem is considered as a linear programming problem. An ergonomic approach is proposed to obtain quantitative estimates of the algorithms of officers' activities. The use of the functional-structural theory of ergotechnical systems made it possible to formalize, describe and evaluate the activities of officers. The obtained probabilistictemporal characteristics of various tasks were used as initial data for solving the optimization problem. To apply this approach in the activities of the leader, an information technology for supporting management decision-making has been developed and described. An example of implementation for two management decision-making strategies is shown in this paper.
The duties of the Chief Information Security Officer (CISO) include not only informing management about the risks to the company’s activities and direct participation in risk management, developing information security documents, studying the latest technologies and security trends, but also implementing other strategic work, such as responding to incidents and assigning tasks to their prevention, analysis, elimination of consequences, etc. Naturally, it is not the CISO himself who performs the specified routine work, but entrusts it to the employees of his service. The reliability of the company as a whole largely depends on the correct distribution of tasks between its subordinates. As a rule, CISO makes such decisions more or less intuitively, based on his knowledge of the health, productivity and reliability of the employees. But such decisions can lead to non-optimal results.
Related works analysis and problem statement
The final areas of information security management in organizations of various kinds
of activities [
2. Resource management of the information security system implemented in the
organization [
3. Management of risks and threats to information security [
4. Management of documentation and information help system in the organization
[
5. Information security audit management [
6. Management of the analysis of the effectiveness of the information security
system [
7. Management of tasks and activities of employees engaged in the processes of
ensuring information security in the organization [
As one can see, the task of managing the activities of employees involved in
information security processes in the organization has not been completely solved. This
task can be considered as one of the tasks of ergonomics - the distribution of functions
between operators-executors. The use of the ergonomic approach allows the manager
to use scientific and practical developments in this subject area. From the point of
view of the ergonomic approach, the operator-manager has the following tasks:
─ organization of activities of executing operators [
In paper [15], the basic principles of the functional-structural theory of ergotechnical systems (ETS) and its application for various tasks of constructing problems of ergonomic quality and such systems with a constant functional structure as the workshop control system are described.
In paper [16], the problem of the distribution of functions for flexible systems with a variable functional structure was solved. One can see that the problem of the distribution of functions can be effectively solved only on the basis of estimates of the accuracy and timeliness of the functioning algorithms, i.e. human-machine interaction processes. This approach can be implemented on the basis of the functional-structural theory of ergotechnical systems [17], which provides tools for modeling humanmachine interaction: ─ formalized description of functioning algorithms, ─ determination of probability-time indicators of the quality of functioning algorithms, and ─ optimization.
This approach can be extended to ensure the reliability of information security management activities. Untimely and erroneous implementation of information security management actions can lead to a violation of the integrity, accessibility and confidentiality of information, which entails material damage.
Information security officers have different qualifications and work experience, which leads to different values of faultlessness and execution time of both individual works and the entire functioning algorithm.
The unsolved problem is the formation of initial data for evaluating the functioning algorithms. It is proposed to take data from special directories that are focused on the average operator. However, there are no such directories for information security management activities.
The purpose of the study is to develop information technology to support the decision-making of the CISO, which ensures the optimal appointment of the security officers to perform information security management tasks.
In this case, it is necessary to take into account various strategies: 1) All employees should be allocated to tasks (one employee - one task) 2) Maximum reliability must be ensured (one employee can perform several tasks; the tasks are not assigned to some employees).
To achieve this goal, it is necessary to solve the following tasks: ─ developing a mathematical model for solving the problem ─ developing an approach to ensure the evaluation of functioning algorithms with source data ─ checking the possibility of using the developed models and approaches to build information technology for decision support of the CISO. 3
The optimal appointment of CISO to perform tasks There are n officers and m actual tasks. Any officer can be appointed to accomplish any task, but with different assumed accuracy of the execution. It is necessary to allocate officers to carry out tasks in such a way that they complete tasks with maximum error-freeness within the available time reserve.
The task can be represented as a following linear programming problem.
n n B( X ) bij xij max , The variable xij represents the appointment of officer j for task i and takes the value 1 if the officer is assigned to complete the task, and 0, otherwise bij is the probability of an error-free operation. Ti is allowable execution time of i task, Mij is the mathematical expectation of the time to complete the operation.
The second strategy assumes that one officer may be assigned to complete only one mission. At the same time, we need the tasks have been completed with maximum error-freeness within the existing time reserve. The restriction determines the assignment of one task to one officer:
i1 j1 n n n xij 1 , (i 1, n) , xij 1 , ( j 1, n) , i1 j1 i1 M ij xij Ti , xij 1;0. 4
Application of the ETS theory for quantitative assessment of the quality of task performance The generalized structural method that underlies the ETS uses a functional network as a description of functioning algorithms (FA). To describe the FA used typical functional unit (TFU) (table 1). To conduct a quantitative assessment of the quality and reliability of operation in the FS apparatus, a set of TFS was obtained.
To build an AF model, it is necessary to prepare a list of work to be performed. Each work put in line with the TFU. For each TFU, determine the probability-time characteristics. Using Table 2 to obtain quantitative indicators of the quality of performance AF [17-19].
diagram “Operation with monitoring the functioning without limitation on the number of cycles”
TFS diagram
n В Bi i1 n M ( X ) M ( X i )
i1 B B1 K 11
1 1 (B1 K 10 B 0 K 00 ) M ( X ) (M ( X р ) M ( X к ))M (L)
M (L)
1 1 (B1K10 B0 K 00 ) The formation of the source data for the task of evaluating the functioning algorithm Providing the task of evaluating the functioning algorithm (FA) with source data is one of the main problems of ergonomic modeling. We cannot accept the assumption of an “average operator” in this study. The proposed approach implements the technology of intelligent analysis [18, 19] of data accumulated in the database of the results of activities of the office employees.
We solve the approximation problem using neuro-fuzzy inference technology [20]. In this technology, a logical conclusion bases on fuzzy logic, and membership functions are adjusted using neural networks. The parameters of the officer, hardware and software, time constraints are fed to the input, and at the output, we obtain probability-time indicators of the quality of the operation.
Information technology for ergonomic support for management decision-making of the CISO Fig. 1 demonstrates the functional structure of the developed system. Let the CISO have the task to formulate a security office work plan. Every information security officer should be given a mission. Currently relevant tasks: ─ Task1 - website check ─ Task2 - audit of wireless networks ─ Task3 - prevention of physical intrusion.
The lead time for the first task is no more than 620; the lead time for the second task is no more than 500; the lead time for the third task is no more than 160. Tasks can be assigned to three officers.
It is necessary to distribute the execution of tasks between officers in such a way as to ensure maximum reliability of the assignment. In this case, the time limit for each task should be taken into account.
To perform each task, the office has developed certain algorithms. So the algorithm for solving each tasks are: Task 1 (website verification), the following actions are performed: 1. Examining the existing site code 2. Examining published vulnerabilities 3. Threat analysis 4. Hacking attempts through existing vulnerabilities 5. QA & TA Analysis 6. Data Analysis 7. Elimination of vulnerabilities and the introduction of new technologies based on the analysis.
8. Testing applications.
To solve Task 2 (audit of wireless networks) consists of the following actions: 1. Definition of existing technologies and coverage 2. Studying the configuration of access points and servers 3. Analysis of traffic and existing threats 4. Attempted unauthorized entry 5. Analysis of the data obtained in paragraphs 1-4 6. The introduction of modified technologies.
Task 3 solution (physical intrusion prevention) involves the following actions: 1. Familiarization with literature 2. Learning from previous invasion techniques 3. Consultation with external sources 4. Independent attempts to penetrate 5. Analysis of all information and conclusions 6. Security penetration Models of performing tasks in the form of a work graph are presented in Fig. 2.
The initial data on the quality of the work operations of the activity algorithms for the implementation of tasks are given in Tables 3-6. p6 The initial data on the quality of the control operation are given in table 6. p7 0,998 240 0,943 247 0,975 245 0,98 64 0,998
61 0,986
62 0,982
12 0,991
15 0,978 13 p6 0,98 56 0,952
54 0,987 55 Here, B1 is the probability of error-free execution of a work operation; K11 is the probability of recognition of a work operation performed correctly, when actually performed correctly; K00 is the probability of recognition of a work operation performed incorrectly, when actually performed incorrectly; and M are the mathematical expectation of the operation time [20-23].
The data in tables 3, 4 and 5 are obtained by the subsystem for the formation of the source data. The principle of operation is based on the use of expert methods of assessment and neuro-fuzzy modeling. The source data are loaded automatically. The manager needs to choose only a list of employees, a list of tasks, and set time limits.
The results are presented in the form of a job assignment matrix (Fig. 3), in the form of correlation of employees and tasks for strategy 1.
Resulting performance indicators (the probability of error-free execution and the mathematical expectation of the execution time) are presented in Fig. 5.
Visualization of the resulting quality indicators makes it possible to visually assess the predicted quality of performance (Fig. 6).
The results are presented in the form of a job assignment matrix (Fig. 7), in the form of correlation of employees and tasks for strategy 2.
Resulting performance indicators (the probability of error-free execution and the mathematical expectation of the execution time) are presented in Fig. 9.
Visualization of the resulting quality indicators makes it possible to visually assess the predicted quality of performance (Fig. 10). The developed information technology allows the CISO to carry out the optimal appointment of his officers to perform tasks to ensure information security. Decision making is based on the obtained quantitative indicators of the quality of the tasks. Reliability of execution is maximized, taking into account time constraints. The structure of officers' activities and their individual characteristics of reliability and speed are taken into account.
However, it should be noted the high complexity of the method at the stage of preparation of the initial data. For successful operation of the system, it is necessary, first, to formalize the algorithms for performing tasks and obtain data on the probability-time indicators of the quality of operations for each officer [24-26]. 6
Conclusions The following main results were received in this paper: ─ It is proposed to use the functional-structural theory of ergotechnical systems to ensure the security of information systems. ─ The approach to the use of the specified method by the CISO for the optimal selection of specific performers from among the employees of the unit is demonstrated to perform information security tasks depending on the quality indicators of the work performed by each employee and the available time limit for the duration of each task, with the goal of maximizing the accuracy of the execution of the functioning algorithms, depending on the quality indicators of each employee. ─ The possibility of such an optimal solution has been taken into account when one performer executes several tasks and tasks will not be given to another potential performer at all.
Unlike previously used methods, the use of the theory of ergotechnical systems to ensure the security of information systems allows us to formalize the process of decision-making by CISO to a greater extent.
The practical significance is that since the task is reduced to the linear programming problem, it can be solved within the framework of a wide class of information technologies and can be quickly included in the CISO’s decision support system in companies of various types of activities.
In the future, studies will be conducted on the use of the functional-structural theory of ergotechnical systems in the development of CISO’s policies, procedures, and guidelines, for example, to assess risks, identify and analyze incidents. Proceedings of 2017 2nd International Conference on Advanced Information and Communication Technologies, AICT 2017, Lviv, 2017, р. 83-87. 14. F. De Felice, A. Petrillo, Methodological Approach for Performing Human Reliability and Error Analysis in Railway Transportation System, International Journal of Engineering and Technology, 2011, vol. 3, issue 5, p. 341-353 15. M.G. Grif, O. Sundui, E.B. Tsoy, Methods of designing and modeling of man-machine systems, Proceedings of International Summer workshop Computer Science, 2014, р. 38-40. 16. E. Lavrov, N. Pasko, A. Krivodub, N. Barchenko, V. Kontsevich, Ergonomics of IT outsourcing. Development of a mathematical model to distribute functions among operator, Eastern-European Journal of Enterprise Technologies, 2016, vol. 2, issue 4 (80), p. 32-40. doi: 10.15587/1729-4061.2016.66021 17. V. Lyubchak, E. Lavrov, N. Pasko, Ergonomic support of man-machine interaction. Approach to designing of operators’ group activities, International Journal of Bio-Medical Soft Computing and Human Sciences, 2011, vol. 17, issue 2, р. 53-58. 18. Zaritskiy O., Pavlenko P., Tolbatov A., Data representing and processing in expert information system of professional activity analysis, Proceedings of the 13th International Conference on Modern Problems of Radio Engineering, Telecommunications and Computer Science, TCSET 2016, Lviv-Slavske, 2016, р. 831-833. 19. Zaritskry O., Pavlenko P., Sudic V., Tolbatov A. et al, Theoretical bases, methods and technologies of development of the professional activity analytical estimation intellectual systems, Proceedings of 2017 2nd International Conference on Advanced Information and Communication Technologies, AICT 2017, Lviv, 2017, р. 101-104. 20. Walia Navneet, Harsukhpreet Singh and Anurag Sharma. ANFIS: Adaptive neuro-fuzzy inference system-a survey, International Journal of Computer Applications 123.13 (2015). 21. S. Gnatyuk, Critical Aviation Information Systems Cybersecurity, Meeting Security Challenges Through Data Analytics and Decision Support, NATO Science for Peace and Security Series, D: Information and Communication Security. IOS Press Ebooks, Vol.47, №3, рр. 308-316, 2016. 22. S. Gnatyuk, V. Sydorenko, M. Aleksander, Unified data model for defining state critical information infrastructure in civil aviation, Proceedings of the 2018 IEEE 9th International Conference on Dependable Systems, Services and Technologies (DESSERT), Kyiv, Ukraine, May 24-27, 2018, pp. 37-42. 23. Fedushko S. (2020) Adequacy of Personal Medical Profiles Data in Medical Information Decision-Making Support System. CEUR Workshop Proceedings. – 2020. Vol 2544: Proceedings of the International Conference on Rural and Elderly Health. 24. Fedushko S., Michal Gregus ml., Ustyianovych T. Medical card data imputation and patient psychological and behavioral profile construction. The 9th International Conference on Current and Future Trends of Information and Communication Technologies in Healthcare (ICTH 2019) November 4-7, 2019, Coimbra, PortugalProcedia Computer Science. Volume 160, 2019, pp. 354-361. 25. Fedushko S., Trach O., Kunch Z., Turchyn Y., Yarka U. Modelling the Behavior Classification of Social News Aggregations Users. CEUR Workshop Proceedings. 2019. Vol 2392: Proceedings of the 1st International Workshop on Control, Optimisation and Analytical Processing of Social Networks (COAPSN-2019). pp. 95–110. 26. Trach O., Fedushko S. (2020) Determination of Measures of Counteraction to the SocialOriented Risks of Virtual Community Life Cycle Organization. In: Shakhovska N., Medykovskyy M. (eds) Advances in Intelligent Systems and Computing IV. CCSIT 2019. Advances in Intelligent Systems and Computing, vol. 1080. Springer, Cham. pp. 680-695.