A mathematical model has been developed for the integrated assessment of the probability of ensuring a safe state of the company's information resources in the face of threats and dangers of unauthorized access to commercial confidential information. This model is distinguished by taking into account the influence of resource factors for ensuring information security, as well as the time factor. Based on the proposed mathematical model, the dependence of the probability of providing a protected state of the company's information resources in a given range of time and resource indicators is constructed. The high efficiency of the joint use of time and resource factors was established to increase the likelihood of a company breaking even by reducing the risk of damage resulting from unauthorized access to confidential commercial information. The possibility of using this model in the tasks of strategic management of the company is justified.
Modern digitalization processes extend not only to local
technological operations of enterprises, but also to the
interaction of economic entities. These are the procedures for
generating proposals for goods, work and services by
manufacturers, their choice by consumers and the formation of
requests for their purchase. Thus, through digital resources, the
flow of material and labor resources is provided [
In such conditions, the opportunities for unauthorized
access to material and financial resources, and, accordingly, the
number of computer crimes in relation to the management of
listed resources, are growing [
II.
DYNAMIC RESOURCE SECURITY MODEL IN THE DIGITAL
The reliability of the security system of the information
resources of economic entities is predetermined by the
operation of protective equipment in the face of threats and
dangers of unauthorized access. The analysis of such tools [
R = (R_1 + R_2 +... + R_n) / N, (2) we have the average value of k and, therefore, we obtain in a general form q (R) = q_0 / k ^ R = q_0 ∙ k ^ (- R), (3)
A, expressing the multiplicity through fixing the base of the natural logarithm of e through the ratio k ^ (- R) = e ^ (- R / R_o) (4) where R_o is the numerical value of the costs, providing a decrease in the probability q by e times: q (R) = q_0 〖∙ e〗 ^ (- R / R_o), (5)
The character of the dependence q (R) is shown in Fig. one.
Figure 1 shows that information security costs
asymptotically reduce the likelihood of cybercrime [
Given that the sum of the probabilities of the safe operation of information resources p and the probability of the implementation of computer crimes q q (R) + p (R) = 1, (6) we get p (R) = 1-q (R), (7)
Thus, the reliability indicator - the probability of failurefree operation of the protection system, is described by the dependence on the volume of resource provision with security tools: software and hardware, the development of new methods, organizational mechanisms, etc. This can be expressed by the formula: p (R) = p_max1 ∙ (1-e ^ (- R \ / R_o)), (8) where: e≈2.71828, p, p_max1 - the probabilities (current value and the maximum possible) of successfully countering the threats and dangers of committing a computer crime, and accordingly - the economic damage caused by it with the basic version of ensuring information security.
Obviously, the use of additional protective equipment in the form of innovative solutions for which no hacking tools have been created due to the unknown operation principle and characteristics of innovations increases the probability of the security state by a certain value p_max2, with p_max1 + p_max2 = p_ (max). Otherwise: p_ (max) = p_ (max) ∙ (a_ (1) 〖+ a〗 _ (2)) In [10, p. 54, fig. 2] the “dependence of the probability of protection” is obtained in time in the form of a sigmoid. We represent the probability sigmoid as a function of the form p (t) = p_max2 / (1 + e ^ (d-t \ / T)) (9) where: T is the time constant of the change in the effect of protection in the conditions of use of the safety equipment; e≈2.71828, d is the number of time constant of the displacement of the median value of the sigmoid relative to the beginning of the reference time.
Now, taking into account the simultaneous influence of previously used protective equipment and innovative solutions, we obtain the resulting probability of protection in the form of the sum of components (as an example, we used the time constant T = 2 years as the average period between software updates in the information security system, Ro = 4, a_ (1) = 0.5; a_ (2) = 0.5):
p (t, R) = 0.5 / (1 + e ^ (4-t \ / 2)) + 0.5 ∙ (1-e ^ (- R \ / 4)), (10)
In fig. 1, the effect of increasing the likelihood of
counteracting damage from unauthorized access to commercial
confidential information is visualized. As can be seen from the
figure, the increase in the likelihood of protection of digital
resources significantly depends on the ratio of time and
resource support of information security. This allows you to lay
down design decisions on the basis of solving the problem of
ensuring the required level of risks, determining a ratio of
resources, and, therefore, costs, and project implementation
time, which is most suitable for the company’s goals, project
implementation capabilities in accordance with its strategy [
It is important to note that the development of a resourcecosting paradigm for ensuring information security by the influence of time leads to a generalized model. Indeed, substituting the only numerical value of time (for example, the current moment of time) into the proposed model leads to a particular case of solving the problem of ensuring information security, for example, during operational control. For the tasks of tactical management in the medium term, time intervals are determined by tactical objectives. To develop a strategy for the development of an enterprise security system, the model can be used at long time intervals during which long-term goals are to be achieved.
In addition, fixing the estimated time, we obtain a model of variable solutions in terms of choosing appropriate investments in information security resources. For example, to select alternative projects offered by information security outsourcers.
The analytical type model compares favorably with the presentation of information security management processes by systems of differential equations, firstly, by the possibility of its practical use. Indeed, office applications (including cloud) allow any user to perform calculations using standard functions, for example, table processors, based on which evaluate alternative solutions to the problem of ensuring information security. It is important that regardless of the type of protective equipment, the methods used in them, the final indicator assessed by the model is the result in the form of an assessment of the achieved probability of safe operation of the information resources of enterprises, their associations, state authorities and many other structures. The model is invariant to the types of their activities, sectors of the economy, patterns of ownership and other features.
The invariance property extends the applicability of the proposed model. It remains fair to new developments not presented on the modern market. This property is of particular value in connection with the unprecedented dynamics of the market of information and communication systems and technologies. Firstly, according to the regularity established by Gordon Moore in relation to the concentration of active keys in the microprocessor hardware and supplemented by David House with observations of the dynamics of growth in computing performance, the first and second indicators double each 18 and 24 months, respectively. Consequently, the use by attackers of more powerful computing power, even based on the simple brute force method, reduces the likelihood of maintaining a protected state of enterprise information systems. Secondly, innovative directions of digitalization of the economy based on smart technologies, processing of large volumes of data, M2M technologies, intelligent systems, cloud services, platforms and infrastructures and several others have been formed and are rapidly developing. The evolution of such information technologies makes unpredictable new places of vulnerabilities critical for economic processes. At the same time, the development of adequate methods and means of protecting information and digital business processes is being carried out taking into account new types of threats and dangers of information security in real time. The companiesdevelopers of such tools always make offers to consumers indicating the terms of development and implementation of information protection tools, as well as the price of products. These indicators are the source data for the developed model. And its use allows, on the basis of direct calculations, to obtain quantitative estimates of the achieved result in terms of information security.
The model can also be used in addition to methods for analyzing hierarchies, decision trees, and many others in decision support systems. It is important that the development of these methods significantly develops the principles of informed management decisions taking into account the time factor. This circumstance is crucial for ensuring the sustainability of enterprises, their development.
Obviously, the time factor plays a crucial role in managing change. Its quantitative accounting allows you to change the paradigm of tactical and strategic management of the enterprise. Instead of tracking changes and following them with a lag in time, it is possible to form changes, providing the company with competitive advantages due to the primacy of the changes. It is equally important that this paradigm is in good agreement with project management methodologies. Note that the traditional project management paradigm leads, as practice shows, to low feasibility of projects. And investments in the development and implementation of projects in the economic activities of enterprises are significantly superior to investments in information security tools.
A model is proposed for an integrated assessment of the probability of ensuring a safe state of the company's information resources in the face of threats and dangers of unauthorized access to commercial confidential information. A distinctive feature of the model is the consideration of the time factor when using innovative solutions to ensure information security in addition to the resource factors for its increase, based on increased costs. A rather high degree of increase in the probability of breaking-even operation of the company is established, exceeding in a specific example considered the effect of the resource approach to reducing risks. The possibility of using the model in the tasks of strategic management of the company, project management of information security, as well as cost optimization. The reliability of the proposed model is confirmed by the proof of model validity by rigorous mathematical calculations.