The risk-based approach (RBA) provides certain advantages in the construction and operation of information security management systems, therefore, the most frequently applied standards in this area are based on it. But the practical application of RBA for protection against cyber threats is fraught with a number of difficulties and limits. It is shown that application of a detailed risk assessment to assess the information security in organization intensively using the Internet and other IT in its activities, require a lengthy work to investigate vulnerabilities, calculating the private risks, reducing them into risks of threat. Taking into account the extremely high labor costs of this procedure, it is relevant to solve the problem by assessing high-level risks. Four verbal specifications of the attacker are introduced, describing various aspects of his behavior and skills, the socio-psychological context of his actions, the target settings of these actions, affecting the choice of the attacker's strategy, methods and ways to implement information threats. On the basis of these specifications reflexive risk models are formed. These are mathematical models whose structure and parameters reflect the characteristics of the attacker contained in its specification. Each of these models can be tailored to its own security policy to minimize losses to the organization. The study of reflexive models in a number of cases made it possible to determine the maximum volume of investments in the information security system and reveal the limitations in the application of the RBA to the construction of the information security system.
In modern society, information is one of the basic resources, the need to protect of which is recognized by the overwhelming majority of business entities. In these conditions, issues related to the protection of information that may be of interest to potential competitors, insiders, intruders, etc. are especially relevant. Taking into account the Copyright © 2020 for this paper by its authors. This volume and its papers are published under the Creative Commons License Attribution 4.0 International (CC BY 4.0). specifics of information resources, including the difficulties arising when trying to evaluate them, as well as the limited financial resources, there is a need for an adequate assessment of the level of reasonable investments in the information security system of organizations that can be determined based on a risk-based approach.
Currently, there are some numbers of regulatory documents governing information security issues. They are the basis for creating systems for assessing both information risk and information security as a whole. The results of information risk evaluating affect the amount of funds invested in information security systems, therefore, one of the important conditions for the normal functioning of these systems is a reliable and accessible procedure for analyzing and assessing of information risks.
The risk-based approach provides certain advantages in the construction and operation of information security management systems, therefore, the most frequently and successfully applied international and industry standards in this area are based on it. Unfortunately, the practical application of risk-based approach for protection against cyber threats is fraught with a number of difficulties. 2
Quite a lot of modern scientific papers are devoted to the research of various aspects of
assessment and risk protection in information systems [
Some academic papers are devoted to deriving an organization’s optimal level of information security investment, among which much attention is paid to the GordonLoeb Model (GL Model) and its modifications [4-5].
At the heart of the most frequently and successfully applied international and industry standards for Information security management systems (ISMS) is a risk-based approach (RBA), which provides some advantages in the construction and maintenance of those systems.
RBA is different significantly from the directive approach to building information security systems (ISS). The directive approach is based on the use of the recommended list of potential threats in terms of availability, integrity and confidentiality of information, which, as a rule, is fully used to form a system of security services when building an ISS. In contrast to directive approach, RBA allows highlighting from the huge number of existing threats and vulnerabilities of information systems (IS) those that are really relevant for the protection of information in a particular organization. This creates objective prerequisites for minimizing investment in information security. A detailed analysis of the mechanisms for the implementation of the limited range of actual threats makes it possible to choose the best methods and means of protection that really correspond to the level of protection guarantees. This allows you to form objective plans and evaluate investment budgets for the creation of ISS and ISMS. The found investment volumes are analyzed from the point of view of the effectiveness of the information security system, compared with the overall budget of the organization, etc. Based on the results of the analysis, the initially introduced levels of protection guarantees can be revised, corrected, re-planning and budgeting of ISS, i.e. the analysis procedure takes on an iterative nature.
The procedure for identifying a group of threats relevant to information security, which is the final stage of the risk assessment process, is called risk prioritization [7]. Risks prioritization in any area involves dividing them into levels, for example tolerable, low, medium, high and intolerable risks, which are usually determined based on the criteria of likelihood and impact / potential consequence [8; 9] or, for example, severity, occurrence and detection [10].
Prioritization of information risks, which are caused by the realization of possible information threats , = 1, , involves, firstly, the identification of private risks for these threats: = , (1) where is a quantitative assessment of the likelihood of the implementation of the corresponding information threat, and is an assessment of losses caused by this threat. After that, it is required to rank the risks in the resulting set { } in descending order of their values and to select from the ranked series its left fragment containing significant for the organization risks. The threats that generate these risks form the group of the required actual threats.
On the basis of a group of significant risks (i.e. risks of actual threats), the value of the integral (generalized) risk is formed. The integral (generalized) risk is calculated by multiplying the possible losses of the organization, which are the result of the combined action of all analysed actual information threats by the probability of these losses , i.e.: = . Integral risk is a universal indicator of the degree of information security, which makes it possible to objectively assess the level of initial threats to information processed in the organization's IS, the level of residual threats (after building an information security system), and the effectiveness of the information security system. The following indicator is used to analyse the effectiveness of the information security system: ) . = ( 1 − = (2) Here 1 is the initial value of the integral risk characterizing the possible losses of the organization due to the implementation of actual information threats in the absence of the information security system, is the residual value of the organization’s integral risk, which estimates possible losses after the introduction of the information security system, and is the amount of possible losses that were prevented due to the establishment of an information security system in the organization.
Since the results of risk assessment affect the amount of funds invested in the information security system, the formation of an understandable and transparent process for analyzing information risks is the most important condition for the successful functioning of ISMS in the organizations. This also explains the strict requirements for the objectivity and accuracy of the calculated risk assessments.
The procedure for finding the integral risk in some cases may be quite simple. For example, subject to the independence and incompatibility of the actual threats and the independence of the consequences resulting from their implementation, the integral risk corresponds to the total risk
= ∑ =1 . However, for organizations with a rather complex structure, having a significant amount of information resources (IR) and intensively using complex information technologies in their work, it will be incorrect to calculate the integral risk as the total risk. In such cases, the integral risk should be calculated taking into account the possibility of the impact of several threats, including their joint implementation with the manifestation of interrelated, interdependent consequences, which is an extremely nontrivial task [11]. In such conditions the use of the total risk as an assessment of the integral risk usually gives a significantly overestimated estimate, contributing to an unreasonable increase in the volume of investments in the construction of ISS. In addition, in formula (1), when calculating private risks as values of and , expert estimates are usually used, which introduces subjective errors into the calculated values, which reduce the reliability of the results of subsequent analysis. Another negative aspect of the risk assessment process described above is its duration and laboriousness, caused, in particular, by the iterative nature of the choice of the structure and configuration of the information security system (taking into account the need to use the integral risk indicator for each iteration, which does not have a general formalized procedure calculation). This approach to assessing information risks, due to its labor intensity and duration, is called detailed risk assessment.
The described above disadvantages of this approach stimulated the development of a more general approach called risk assessment of a high-level organization, which is given in the current state standards of Ukraine [12; 13]. In this more general approach, the technological aspects of risk assessment of the organization do not play a leading role; in particular, a detailed analysis of IS threats and vulnerabilities is not carried out. Instead, the emphasis is on generalized risk scenarios, the degree of dependence of the organization's business on the status of its information assets, in particular, on the overall level of the organization's investment in information security. This approach is focused primarily on solving general strategic aspects of information security: organizational, economic as well as basic technical issues.
If it is necessary to ensure the safety of especially valuable assets, a detailed risk assessment procedure is additionally carried out, which in this case is not iterative in nature and does not require the subsequent calculation of the integral risk through a set of significant private risks. This approach to risk analysis is called a combined approach [12]. It guarantees obtaining a full and technologically completed solution to the problem of building the organization's information security system after conducting a highlevel risk assessment.
Note that the goals and methods of using RBA for the analysis and assessment of the organization's information security are not defined uniquely, much depends on the properties and characteristics of the organization itself. Of particular interest is the generalization of the known practical results of the use of RBA for solving information security problems, the formalization of procedures in which RBA is the basic methodology, the assessment of the prospects of RBA for protecting organizations from modern cyber-attacks.
Let's apply RBA to assess the information security in an organization with a fairly comsively using the Internet and other information technologies in its activities. plex regional structure, having a significant distributed information resource , inten
A preliminary analysis of possible threats to the information resources of this organization, carried out using the list of threats given in the ISO / IEC 27005 standard [13], allows to claim the following.
Nine out of 77 threats presented in the list are associated with the impact of natural phenomena (climatic, seismic, volcanic, meteorological and flooding), and of an accidental nature (hardware failure and equipment failures, software failures and errors). Effective decisions to minimize the risks associated with them can be made immediately only for these nine threats.
The remaining 68 threats represent the implementation of deliberate malicious acts aimed at information assets. The source of these threats is a person: a malefactor (intruder) or a group of malefactors. Note that the same threat can be implemented using different attacks (mechanisms) based on the use of various vulnerabilities of information systems of organizations. At the same time, the degree of success of the attack (i.e. the probable parameter risk) and the level of possible losses of the organization directly depend on the potential of the attacker – the competence, resources and motivation of the malicious [14]. mation security system.
It is obvious that the application of a detailed risk assessment in this situation will require a lengthy and painstaking work to investigate vulnerabilities and enumerate the attack mechanisms implemented on their basis, to find out the missing information for calculating the private risks of individual attacks, reducing them into risks of threat, etc. in accordance with the detailed evaluation procedure outlined above. Its intermediate result will be the calculation of a value 1, a pair of values version of the information security system, evaluating the effectiveness of this version of the information security system, making adjustments and changes to it (in the mode of possible reusable iteration) and finally determining the acceptable (in accordance with the adopted system of criteria) investment amount in the organization's infor, for the proposed
Taking into account the extremely high labor costs of this procedure, it is relevant to solve the problem by assessing high-level risks, excluding the use of an iterative procedure as well as without resorting to preliminary calculation of partial risks. It should be noted that such solutions have actually already been obtained in [6; 11; 15], although the problem statement there was somewhat different. In this regard, in the materials presented below, a number of results will be presented only with references to paper in which they are given.
We use the so-called two-factor formula to describe the integral risk: = . (3) where the probability of occurrence of losses is represented by multiplication = .
Here is the likelihood of an attacker’s motivation (his interest in the organization's information resource , prompting him to commit any attacking actions aimed at this resource), - the likelihood of a successful use of the organization's IS vulnerabilities by an attacker to implement his attacking actions. Structuring the probability is convenient in that the probability of motivation is actually determined only by the level of interest of the attacker to the information resource of the organization, which makes it expedient to find this probability in the form of a single expert assessment. One way to get this estimate is the using a heuristic dependence ( , ) = − = 1 − , commercial gain. where is the value of the resource for the malefactor (attacker), is the generalized costs of preparing and implementing attacking actions by the attacker, presented in a monetary form,
− is the attacker's net profit in the case of a successful attack. Obviously, the higher is , the closer to 1 the probability . With a decrease , in the case ≤ the attack becomes meaningless, unless the interests of the attacker go beyond
It should also be noted that there are two features that are important for the practical application of formula (5): the parameters included in expression (5) are determined only by the interests and motives of the attacker's behavior; the perceptions of the value of the same information resource by the attacking and defending sides is generally different – “asymmetric” [11; 15; 16]. For example, for the owner of a resource, its value is usually calculated based on an analysis of the cost aspects of creating this resource, the calculation procedure is often typified, and the obtained estimates are quite stable. For the attacking side, the value of the "extracted" information is formed on the basis of the market value of the resource and the number of potential buyers wishing to get it in their property. Thus,
≠ .
The probability of a successful attack is determined by the ratio of the potentials of the attacking and defending sides and can be represented by a next heuristic equation: (4) (5) ( , , ) =
, (6) =
where is the total volume of investments in the organization's information security, is the coefficient of asymmetry in the perception of the value of information by the attacking and protecting sides, is the coefficient that determines the level of efficiency of investments in the information security: subject to the same investment volume , the higher the value , the lower the probability value . The value of the coefficient depends on the organization's attitude to information security issues and is determined by the level of maturity of the organization in the field of information security management. It is possible to obtain a quantitative (point) assessment of the level of maturity by applying the methodology described in [7] for self-assessment of the level of maturity of the risk management system in an organization. The score found by this method should be used as the desired value. The maximum possible value corresponds to 85 points, a high level of maturity of the organization is characterized by a range of 51 to 85 points. at practically unlimited costs, in this case → ∞ , = 1.
It’s obviously if an information resource is not interesting for an attacker, in this case → 0, the coefficient → 0 as well as probability of a successful attack → 0. On the contrary, if the resource is of no value to the organization owner, there are practically no investments in the information security system ( = 0), and = 1. Finally, if the attacker is extremely interested in the resource and is ready to receive it
Substitution of expressions (5), (6) into formula (3) makes it possible to construct a formalized generalized model of integral risk (7) (8) ( ) = (1 − ) + in which the value is included as one of the parameters, and then make in general form the dependence of the prevented losses ( ) on the level of investment in the
To conduct research within the framework of a high-level risk analysis, we will define the concept of the organization's information security system efficiency. We will largest. The effective volume of investments in this case will be [11, 15]: assume that the fulfillment of the condition ( ) > is obligatory for an effective ISS. Then we will consider the most effective ISS for which the difference ( ) − = с( ), representing the "net profit" due to the construction of the ISS, seems to be the = alized integral risk model (8) does not allow finding where С is the set of values for which ( ) > . Unfortunately, the use of the generexplicitly in the analytical form. However, in a number of cases, applying a more detailed description of the capabilities and properties of the attacking side, the motivational and economic aspects of its behavior, it turns out to be real to obtain an analytical solution to the optimization problem (8) and much information that complements this solution. 4
Now we will consider four verbal specifications of the attacker, reflecting various aspects of the behavior and preparation of the attacker, social and psychological context of its actions, the existing (often prescriptively determined) target settings for these actions, which largely affect the choice of an attack strategy, methods and ways of information threats implementing. According to the introduced specifications, reflexive risk models are formed. Each model has certain features depending on the characteristics of the attacker. attack mechanisms, moreover, they do not understand the mechanism of action of the old ones, basing their actions in the implementation of threats mainly on the application of the enumeration principle. Therefore, the basic level of security, which is competently embodied in the organization's information security system, focused on the use of means and methods of protection against already known "old" threats, is quite effective for countering attacks by the script kiddies.
This conclusion corresponds to a reflexive risk model of the form: ( ) = +
, =
, where the probability of a successful use of an organization's IS vulnerabilities by an attacker to implement his attacking actions is determined by It follows from (10) that the information security in an organization primarily depends on internal parameters: the amount of investments in the ISS, the level of organization maturity (determined by the value of the parameter ) and the value of its information (9) (10) с( ) = ( ) − =
− с, = ( − 1), bility (10). resource. An increase of the values and leads to a decrease in the values of proba
Having calculated for the reflexive risk model (9) the value of prevented losses ( ) and, compared it with the volume of investments in the information security system, we find the "net profit" of the organization due to the construction of the ISS: (11) (12) (13) Analysis of expression (11) allows determining [6; 11] the range of "reasonable" investments 0 ≤ ≤ ( − 1
) within which ( ) > . Here is the formula for calculating the effective volume of investments: conditions of an effective investment volume: as well as formulas for calculating the value of the probability . and risk under the ( ) = 1 , ( ) = ( ) = ., assets. protection.
Within the range of "reasonable" investments, the dependence of the values of the effective volume of investments
on the parameter has a one-extreme character with a maximum: [
( )] = 0,25 [11, 15]. Obviously, the largest value of effecbe tive investments in ISS will be at = 1, while the maximum investment in ISS will = 0,25 , i.e. 25% of the cost of the resource , which is the object of protection. For highly effective security solutions (for example, = 60) in accordance with formula (12), even with = 1, the volume of investments in the ISS can be at the level of 11-13% of the cost of the protected resource. The obtained results are in good agreement with the empirical estimates of the volume of investments given in a number of publications the authors of which focus on the amount of 15-20% of the value of IS
It should be noted that as well as script kiddie the various network infections and worms, excluding zero-day attacks, can be successfully eliminated at the basic level of 4.2
risk model for this case will be as follows: The attacker is represented by a professional or a group of professionals with the necessary knowledge, skills and sufficient experience, for which hacking is the main activity of a frankly commercial nature. A professional hacker usually has some financial and economic resources, but for him, nevertheless, the limitation ≤ remains quite relevant. If the cost of the information resource is estimated by the sides of the attack and defense approximately the same, i.e. the asymmetry coefficient = 1, the reflexive (с) = (1 − )
The research of formula (14) for = 0 allows to estimate the boundary values of the range of reasonable investments: 0 ≤ ≤ . With increasing values of , for → 2 the right and left boundaries of the range approach, contracting to the point = 0,25 2. In this ultimate case, the largest investment in the information security system will be
= 0,5 , i.e. 50% of the cost of the resource [11, 15]. The expenditure of this volume of investments requires an analysis of possible threats to information security, the identification of actual threats, the implementation of a protective measures system in the form of an integrated information security system (IISS) under conditions of optimal allocation of investments.
As noted above, the attacker can invest significant funds in organizing and conducting an attack, comparable in magnitude to the value of , but as a rule the allocated attack potential does not exceed the limits of economic feasibility. However, in the case >> 1, i.e. with a significant asymmetry in the perception of the value of information by the attacker and defender, a situation arises that can be defined as a long-term targeted attack. At the same time, the attacking side, which has previously allocated hefty resources for preparing the attack, but has not yet achieved success, switches to waitand-see tactics, accompanied by constant monitoring of the quality of the functioning of the attacked organization ISS. Sooner or later, in the event of a local decrease in the level of its security (the appearance of even a short-term vulnerability), the attacker carries out a successful attack. In this case, the attacker's main expendable resource is his time and the costs of monitoring the security status of the attack object.
From the formal point of view, if ≠ 1, when → ∞ the probability of the threat activation is → 1, i.e. the threat exists constantly and its implementation will occur as soon as the opportunity presents itself. If there is an insider in the attacked organization, he can report the onset of this moment or try to create it. This moment will correspond to a local burst of probability , which, according to the definition introduced in [11], is a “terminal” probability, the value of which changes over time in accordance with the chosen attack tactics. In this case defensive side should choice a strategy of socalled proactive defense, based on the research of the behavior, tactics and strategy of the attacking side, i.e. used the approaches and principles of reflexive control [19]. Proactive defense strategy allows defensive side to postpone the onset of the moment of successful implementation of the threat theoretically for an unlimited period of time.
Thus, the IISS, built only in accordance with the requirements of the current regulatory documents of the ISS system, does not provide sufficient guarantees of protection against attacks in cyberspace implemented today: targeted advanced persistent threats, advanced evasion techniques. The complexes of protective measures used today are young effective against these threats. In this regard, the development of proactive defense systems using the approaches and principles of reflexive control is promising. The attacker, in order to achieve his goals, resorts to the services of a hired contractor who is obliged to do his job under any circumstances. In particular, if his task is to implement any information threat, the professional executor immediately proceeds directly to the search and exploitation of the vulnerability of the organization's IS, i.e. it is obvious that in this situation = 1.
In the previous specifications the attacking side in its actions is guided by the principle of economic expediency (reasonable sufficiency).
Unlike them, a feature of specification 3 is that due to the special importance of the task assigned to the professional executor, resource constraints are removed and, moreover, he can count on attracting various additional resources to support his actions: financial, technical, operational as well as information and analytical etc.
In practice this means the possibility of implementing very high-cost attacks ( → ∞) within the framework of Specification 3. A typical example of such situation is the implementation of a particularly important task by an undercover man who is a professional trained to carry out attacking actions in cyberspace [15; 19].
The reflexive risk model for this case is simple: = =
+ It is obvious that with the removal of resource constraints ( → ∞) the probability
→ 1, i.e. the successful implementation of the threat by the attacker is practically guaranteed and, as a result, ( ) → . This is achieved through the implementation by the attacker of new original attacks, protection from which is almost impossible to envisage within the framework of the standard RBA methodology presented in the current risk management guides, based on the research and analysis of previous security incidents. 4.4
The attacker is an ideological hacker who use computer systems for a politically or socially motivated purpose [16; 17; 19].
He seeks to transfer the promotion of political or social ideas (often of a rather dubious nature) to cyberspace, organizes actions of civil "electronic" disobedience in cyberspace, trying to attract the attention of the authorities and the public (sometimes in a rather tough form) to certain issues and problems of modern society through the synthesis of social activity and hacking. The most typical hacktivists actions are website defacement and computer hacking, in particular denial-of-service attacks, e-mail bombing as well as computer viruses and worms.
There is practically no commercial component in the actions of a hacktivist, his attack potential, in particular resource provision, is usually limited, therefore Specification 4, depending on the resources available to the hacktivist, may be close to Specification 1 or 2. Having established that the hacktivist belongs to a particular protest community, it is possible with a high degree of probability to assume the type, duration, mass, intensity and possible consequences of hacker attacks. Therefore, the use of ROA in such situations can be quite effective. 5
The analysis of reflexive risk models shows that they are focused on a certain set of attacker properties, which forms specific aspects of its behavior, the social and psychological features and target settings of its actions, which largely affect the choice of the attacking strategy, and methods of threats implementing. Each of these models can be tailored to its own security policy to minimize losses to the organization. Development of these security policies determines the content of an adaptive approach to managing the information security process in an organization. At the same time, "adaptive management" [19] refers to the process of applying a targeted choice, and, if necessary, changing the parameters and structure of the organization's ISS in order to make adequate decisions to ensure the required level of protection of its information resource from attacking actions of an intruder, harmonizing the financial and economic capabilities of the organization with its requirements and opportunities in the field of information security, ensuring effective and rational investment in the organization's information security system.
The study of reflexive risk models, reflecting for a number of typical "attack-defense" situations the characteristic features of the behavior and actions of the attacker, presented in the Specifications 1, 2 and, 4 (script kiddie, professional hacker, hacktivist), makes it possible to analyze high-level risks, predict estimates of the marginal volume of investments in the organization's information security, prioritize risks and identify a group of relevant information threats, thereby ensuring an effective distribution of funds invested in the organization’s information security.
An analysis of the application of RBA to building an organization's information security system using the risk model defined in the Specification 2 (Professional hacker) for long-term targeted attacks leads to the conclusion that it is impossible to provide sufficient guarantees of protection against a number of attacks, implemented in cyberspace.
Considering that the basic methodology of RBA, presented in the information security risk management standards, is based on the research and analysis of previous security incidents, the successful use of RBA to build an effective information security system that allows reflecting new, unpredictable attack history is not possible. In this regard, the use of RBA for building an information security system against hired professional executor (Specification 3) is useless. 2. Butusov, I., Romanov, A.: Methodology of security assessment automated systems as objects critical information infrastructure. Voprosy kiberbezopasnosti [Cybersecurity issues]. 25, 2–10 (2018). Doi: 10.21681/2311-3456-2018-1-2-10 . https://cyberrus.com/wp-content/uploads/2018/05/02-10-125-18_1.-Butusov.pdf 3. Buchyk, S., Shalaev, V.: Analysis of instrumental methods for determining information security risk information and telecommunication systems. Knowledge-based technologies, 3(35), 215–225 (2017). 4. Gordon, L., Loeb, M., Lucyshyn, W. and Zhou, L. Empirical Evidence on the Determinants of Cybersecurity Investments in Private Sector Firms. Journal of Information Security, 9, 133-153 (2018). Doi:10.4236/jis.2018.92010. 5. Gordon, L.A., Loeb, M.P. and Zhou, L. Investing in Cybersecurity: Insights from the Gordon-Loeb Model. Journal of Information Security, 7, 49-59 (2016). https://doi.org/10.4236/jis.2016.72004 6. Arkhypov, O.Ye., Arkhypova, Ye. O.: Features of the definition of the volume of investment in protection of information resources. Investment: Practice and Experience, 11, 7174 (2015). 7. A guide to managing security risks. Microsoft Solution Development Group for Security and Compliance, Regulatory Standards and Microsoft Security Center of excellence. http://infoeto.ru/download/rukovodstvo-po-upravleniyu-riskami-bezopasnosti.doc 8. Software Risk Management: A Practical Guide, https://www.energy.gov/sites/prod/files/cioprod/documents/Risk_Management.pdf. 9. Risk, Issue, and Opportunity Management Guide for Defense Acquisition Programs. Office of the Deputy Assistant Secretary of Defense for Systems Engineering, Washington, D.C. (2017). http://acqnotes.com/wp-content/uploads/2017/07/DoD-Risk-Issue-and-Opportunity-Management-Guide-Jan-2017.pdf 10. Sellappan, N., Palanikumar, K. Development of Modified Evaluation and Prioritization of
Risk Priority Number in FMEA. International Journal of Engineering. 7, 1, 32–43 (2013). 11. Arkhypov O. Introduction to risk theory: Information risks. Kyiv, Nat. Acad. SBU (2015). 12. DSTU ISO / IEC TR 13335-3: 2003 Information technology - Guidelines for the management of IT Security - Part 3: Techniques for the management of IT Security. – Kyiv, Derzhspozhyvstandart of Ukraine (2005). – ІІІ. 76 р. 13. DSTU ISO / IEC 27005: 2015 Information technology -- Security techniques -- Information security risk management – Kyiv, UkrNDNTS (2016). 14. GOST R ISO / IEC 15408-1. Information technology. Methods and means of ensuring security. Criteria for assessing the security of information technology. Part 1. Introduction and the general model. 15. Arkhypov A.E. The use of economic and cost models of information risks for assessing the limits of investment in information security. Zahist Informatsii, 17, 3, 211-218 (2015). http://ceur-ws.org/Vol-2608/paper14.pdf 16. Arkhypov, O.Ye., Arkhypova, Ye. O.: Risk approach for determining limit values of the level of investment in information security. Information security of man, society, state, 2 (18), 61-70 (2015). 17. Yermalovich, P., Mejri, M.: Ontology-based model for security assessment: Predicting cyberattacks through threat activity analysis. International journal of network security & its applications. 12 (2020), https://ssrn.com/abstract=3623746 18. Nycyk, M.: The new computer hacker's quest and contest with the experienced hackers.
International Journal of Cyber Criminology (IJCC). 10(2): 92–109 (2016). DOI: 10.5281/zenodo.163402/ 19. Arkhypov, A.., Arkhipova, S.: Adaptive aspects of building of information security systems.
In: Proc. of 2020 Ist International conf. on Security of information systems resources, pp.3743, Сhernihiv (2020).