This work aims to study the problem of identifying and assessing information security risks in complex, distributed, and scalable information systems, as well as building a profile of key risk factors that can cause potential information security incidents in the physical and functional allocation of resources. As part of this work, a study was carried out of the main information security risks that can be identified at the time of creating and operating a typical distributed information system designed to support information processes and provide information services. The result of the study is the ranking of major risk factors according to their importance and frequency in practice, as well as highlighting the most significant security controls. The data for analysis was compiled based on the results of interviews and questionnaires of information security specialists with different training levels and different focuses in their activities within this knowledge area. The paper presents summarized information on classical approaches to information security risks quantitative, qualitative, and hybrid analysis, as well as the latest methodologies based on solving the problems of intelligent classification and analysis of data on risk factors in the system distribution, and in operation with large data sets.
Today, information security management plays a key role in the life processes of almost any organization that uses modern technologies for collecting, processing, and storing information. This process is based on the regular assessment of information risks, which allows you to timely identify new threats and vulnerabilities, implement appropriate measures to neutralize them, and continuously monitor the state of information security of the system, considering the previous experience and new factors.
To prepare for potential attacks and possible problems of this nature, as well as to prevent disruptions to business processes and operations, damage to reputation, or loss of data, organizations must constantly assess their risk profile, make recommended corrections, and actively improve their security system. Threat analysis and risk management are the cornerstones of any security policy. Cybersecurity risks should be considered as a key factor in the strategic planning of business processes. That is why it is the responsibility of each company to develop a risk assessment methodology that best suits the organization's priorities and business goals.
The importance of risk management as a process in modern reality is undeniable. The modeling and forecasting information security risks task has been and remains a significant and priority. This issue is especially relevant in the context of the widespread of complex multi-component information systems
2020 Copyright for this paper by its authors. that have a distributed nature and contain a large number of nodes. The total number of computer systems, active network equipment, and peripherals installed in any infrastructure is growing at a phenomenal rate. The relative simplicity of networking is a compelling reason to interconnect computer systems, share functions, and share resources. This approach allows better use of a computing power vast set that is currently available, but on the other hand, raises some issues primarily related to the complexity of security and potential risk management. The transition to complex, large-scale, and structurally complex information systems increases the likelihood of unforeseen and unplanned events affecting the performance and operability of the system as a whole.
The widespread introduction of distributed information systems (DIS) today is representative of almost all areas of human activity, where they are entrusted with solving more and more important tasks. The efficiency of decision-making and the efficiency of the functioning of many economic, social, political, and military structures depend on the quality of DIS functioning.
Distributed information systems are complex technical systems consisting of many structural elements, functionally combined to provide one or more types of information processes and the provision of information services. Such systems typically operate under random factors, the presence of negative influences of various natures, active interaction with the external environment, and the high cost of impacts of possible violations or malfunctions. All this causes many problems related primarily to information security. Managing the cybersecurity risk assessment in distributed systems involves solving a set of problems related to functional distribution and hierarchy, a high degree of resources parallelization, and a near-complete lack of centralized management.
On the way, there are difficulties to the analysis of heterogeneous data, the need to reconcile
information obtained from different sources, the variability of distributed metrics, which requires a wide
arsenal of tools for analytical processing and intelligent data processing of different nature, the problem
of incomplete information about the components of a distributed system and the complexity of
integrated multifactor analysis in general. There is a need, on the one hand, for a set of methods and
tools that can eliminate these obstacles, and on the other hand, for a new approach to organizing research
on information security risks in a distributed environment and performing comprehensive analytical
processing of distributed data of various natures. Therefore, the implementation of a new approach to
managing risk assessment in DIS involves the introduction of a comprehensive solution that integrates
data obtained from different sources and a wide range of tools for their analysis [
Several international organizations and leading universities are engaged in research on this issue. The key standards in this area that need to be relied on are ISO / IEC 27001: 2013, NIST SP 800-30, and BS 7799-3: 2017. However, despite significant achievements, there is currently no single system vision of all aspects of the problem, the nature, and features of research tools, and its place in the process of multifactor risk analysis of a distributed system, considering the entire complex of interrelations and mutual influence of the processes associated with it. The different degree of depth of elaboration of certain aspects of this problem has led to the need for effective models and methods of reconciliation and analytical processing of heterogeneous data for rapid analysis of the current state of information security of a distributed system. 2.2.
Information security risk assessment is an extremely important part of a company's data protection strategy. It is conducted out to support decision-making and immediate response to identified threats (risk response).
Information security risk analysis allows you to determine the necessary and sufficient set of
information security tools, regulatory and organizational mechanisms to reduce information security
risks, allowing to ensure the process of building the most effective information security management
system architecture for a given organization [
Risk management is an iterative process of identifying, quantifying, analyzing, and managing the
risks faced by an organization [
In terms of systemic distribution, risk management should provide for a complex nature, and consider the risk assessment for each asset or subsystem.
The specificity of the architecture of distributed information systems involves the analysis of data, largely differentiated in their structure, and the use of all available tools of assessment methods (both quantitative and qualitative) that characterize various components of the studied environment. The poor structure of the tasks of such research resulted from the lack of formal models and obtaining objective measurements results together with subjective expert assessments.
Thus, the risk management process in distributed information systems is a sophisticated and rather integrated task.
The study of risk factors in a distributed environment deserves special attention.
According to ISACA's annual STATE OF ENTERPRISE RISK MANAGEMENT 2020 survey [
On the other hand, according to this study, the most frequently used control to prevent/mitigate potential security concerns is to raise awareness and conduct training on cybersecurity among staff (Figure 2).
Eighty percent of enterprise respondents provide awareness-raising training, 68 percent use
disaster/incident recovery strategies, and 67 percent use general information security control and
management. Less than half of the responding businesses use insurance as a mitigation control; at the
same time, the largest supporters of this approach are companies in North America and Africa [
There are many different methods for analyzing information risks for distributed systems. Their main differences are the approaches and the scales being used for assessing the risk level: quantitative or qualitative.
Conventionally, among the methods of risk assessment, the following three groups can be distinguished: 1. Statistical methods 2. Methods of expert assessments 3. Modeling methods
To assess the information security risks, a qualitative, quantitative, or combined approach can be used.
In quantitative methods, the risk is assessed in the form of numerical values. Accumulated statistical information on incidents and violations, as well as meta-information about the current state and configuration of the node components of the distributed system, are usually used as input data for the assessment. However, the frequent lack of sufficient statistics leads to a decrease in the adequacy of the assessment results. Other limitations are complexity, high labor intensity, and long execution time, especially in the terms of the analysis of distributed systems. The advantages of the quantitative approach include the accuracy of risk assessment, clarity of results, and the ability to compare the risk value, expressed in financial equivalent with the investment amount required to respond to this risk.
Qualitative methods are more common, but they use too simplified scales, usually containing three
levels of risk assessment (high, medium, low). The assessment is based on expert surveys, and
promising intellectual methods are still insufficiently applied. Other disadvantages are the lack of
visibility and complexity of using the results of risk analysis for economic justification and assessing
the feasibility of investing in risk response measures. The advantage of a qualitative approach is its
simplicity and minimization of the time and labor costs for conducting a risk assessment [
The combined approach involves a combination of both methods to apply the benefits of each.
According to "The Marsh Microsoft 2019 Global Cyber Risk Perception Survey" (September 2019),
the popularity of a quantitative approach to assessing information security risks has increased
significantly compared to 2017, but it remains low (Figure 3) [
Thus, today most companies use a qualitative scale to assess information security risks.
If it is impossible to use statistical methods for analyzing the risks of a distributed system (lack of information on risk factors, insufficient data sampling size, complexity and sophistication of infrastructure, etc.), you should refer to expert assessment methods. The essence of the method of expert assessments is to conduct an expert analysis of the problem using qualitative and quantitative assessment of hypotheses and further processing of the results. This method is simple and accessible for practical application but requires a significant level of competence and extensive practical experience from the expert.
When using expert methods, the risk level is assessed based on the analysis of the probability of an adverse event occurring by studying and assessing the factors affecting it. Thus, the practical application of this method is to establish a list of factors that determine a particular type of risk, as well as to determine the relationship between the nature of the factor and the risk level that this factor causes.
For the objectivity and impartiality of the results, the work on identifying and assessing information
security risks should be carried out by special experts or relevant expert groups who have the necessary
experience and training on this matter issue [
The most effective methods for analyzing information security risks in distributed systems are
modeling methods [
Artificial Intelligence (AI) is not a new concept, but only in recent years, various companies have begun to explore and understand its full potential. Intelligent systems play an increasingly important role in network management. Most research in intrusion detection and risk assessment systems heavily relies on AI techniques to design, implement, and improve security monitoring systems.
Recent malware updates and improvements in cyberattacks are difficult to detect with traditional cybersecurity techniques. An important advantage of neural networks is their ability to "learn" the characteristics of the input data and identify elements that are not similar to those previously observed in the system. New AI algorithms use machine learning to quickly adapt and analyze new data, improve results and identify new vectors of risk implementation.
Most modern methods of attack detection and risk assessment leverage some form of rule-based analysis or a statistical approach. The analysis relies on a set of predefined rules created by the administrator or by the security system itself.
Unlike expert systems, which can give the user a definite answer about the compliance of the
considered characteristics embedded in the knowledge base rules, the neural network analyzes the
information and provides an opportunity to assess, reconcile the data with the characteristics it is trained
to recognize [
Thus, forecasting and modeling the level of risk, coordination, and intelligent processing of various nature data about risk factors and creating based on their analysis a comprehensive approach to risk assessment in distributed information systems is a priority research area today.
The purpose of this study is to highlight the key risk factors inherent in modern distributed information systems, analyze the most significant security controls for development based on their recommendations to eliminate potential threats. 3.1.
A questionnaire method was used to collect a sample of test data for analysis. The respondents were several dozen information security engineers of various training levels, penetration testing and auditing specialists, and leading specialists in the field of information security project management. All interviewees were selected selectively and have experience in providing security for information system infrastructures of various sizes and scales.
The study involved two data collection processes for analysis. The first is a pilot survey to test the research instruments and adjust the questions, the second is a mass survey of the target group using the final version of the questionnaires.
The pilot study was performed before the main questionnaire and aimed to test whether the proposed model of the questionnaire is suitable for the analysis of the final metrics. 23 specialists (Table 1) were involved in the main survey. Age of survey participants from 24 to 47 years, with an average of 34.2. 3.2.
The development of questionnaires considers the most common risk factors that are common to most modern distributed infrastructures. The questionnaire included 40 questions on the main risk factors and 14 questions on the practice of applying security controls in real projects. These indicators were identified at the stage of analysis of literature sources in this subject area and during the pilot survey. The respondents were asked to answer these questions anonymously and subjectively, relying on their own experience and the real practice of working with distributed information systems.
IBM SPSS Statistics software toolkit was used for data analysis and modeling as it is widely used for statistical analysis by market researchers, health researchers, survey companies, government, education researchers, marketing organizations, data miners, and others. The research findings are analyzed and discussed in the following sections.
The share of female respondents among the interviewers is only 26 percent. 3.3.
The respondents were asked various questions that used scales from 1 to 5. To increase efficiency and narrow the gradation of possible results for assessing risk factors at work, a 5-point scale was chosen, in which the indicator “does not matter” is equal to one, and “extremely important” is equal to five. Likewise, there are five categories for assessing security controls so that the “never” indicator is one and the “always” indicator is five. Thus, all questions about risk factors in distributed systems were measured on a five-point Likert scale from “nonsignificant” to “most important”, and all security controls – from "never" to “always”. The Likert scale is quite easy to build, it provides relative reliability even with a small number of judgments, and the data obtained is easy to process. The selection of judgments for the scale was carried out based on an analysis of literary sources in a given subject area and during pilot research by the method of selection from an initial list of judgments with the most discriminatory ability to the measured attitude. For this purpose, an initial list of statements was created (Table 2) that were offered to respondents from a group representative of the target audience (participants in the pilot study). 2 With a background in the field of cybersecurity № 1. 2. 3. 4. 5. 6. 7. 8. 9. 10.
11.
When working with the scale, the respondents rated the degree of their agreement or disagreement with each of the proposed judgments, from “completely agree” to “completely disagree”. 3.4.
The study demonstrates 40 main risk factors in modern distributed information systems (Appendix 1, Table A1), labeled from Factor_1 to Factor_40, which are quite common in the relevant literature, are often found in practice, and are widely used by researchers and experts in cybersecurity when studying risk factors and conducting risk management measures. These factors should be identified in the process of assessing and managing information security risks and monitored in the future.
Separately, the risks caused by a human factor should be highlighted. They include not only employee mistakes, but also intentional actions that lead to violating information confidentiality.
Referring to the NIST SP 800-37 Risk Management Framework, should not forget about such categories shown in Table 3.
Category Financial risks
Legal risks Business risks Political risks
Software risks Risks of non-compliance with legislation
Security and confidentiality risks
Project risks Reputational risks
Risks of life safety
Risks of strategic planning
They were not considered in this study, however, constitute an important part of any risk
management process [
As a result of the analysis of the above statistical data, the expert group proposed possible categories
of actions to minimize information security risks, including organizational and legal protection of
information, engineering, hardware and software protection, cryptographic mechanisms for protecting
information [
As effective controls to ensure the security of distributed systems by trained full-time specialists or
with the help of information security outsourcing, the following solutions (both separately and in
aggregate) can be implemented, shown in Table 4. The ISO 27001 standard and its Appendix A are
important tools for information security management [
Separately, it should be noted the international standard ISO/IEC 27005: 2018 “Information
technology – Security techniques – Information security risk management”, which contains
recommendations for information security risk management. This document supports the general
concepts defined in ISO/IEC 27001 and is intended to guide the implementation of information security
measures based on a risk-based approach [
Thus, the proposed options cover the entire range of the most common risk management mechanisms and measures used in modern distributed systems.
Table 7 (Appendix 1) shows that nearly all respondents ranked factors related to lack of cybersecurity policy, lack of protection mechanisms against network attacks, violations of authentication and session management, violations of access control, and use of components with known vulnerabilities as the most important.
The uncorrected sample standard deviation S is calculated (1) for four groups of factors, each of which contains 10 of them where {x1, x2, …, xn} are the mean values of the sample items, n = 10 – the size of the sample (number of factors in each group: Factor_1 – Factor_10, Factor_11 – Factor_20, Factor_21 – Factor_30, Factor_31 – Factor40), and ̃ – the mean value of this assessment (2) = √ ∑ and summarization of the survey responses gave the following rating of the importance of the listed risks (in order of importance): Factor_20, Factor_6, Factor_10, Factor_11, Factor_12, Factor_14, Factor_8, Factor_9, Factor_4, Factor_3, Factor_13, Factor_17, Factor_18, Factor_1, Factor_15, Factor_15 , Factor_5, Factor_7, Factor_16.
Among organizational factors, the risks associated with the lack of cybersecurity and anti-virus protection policies are the most important. The ranking of the importance of risks in this category (in order of importance): Factor_21, Factor_27, Factor_30, Factor_28, Factor_29, Factor_25, Factor_23, Factor_24, Factor_22, Factor_26.
In addition, all respondents noted that the risk of abuse of privileges is the highest risk factor and very important among the factors associated with the human factor. Risk severity rating for this category (in order of importance): Factor_33, Factor_40, Factor_35, Factor_37, Factor_38, Factor_36, Factor_34, Factor_31, Factor_32, Factor_39.
In summary, the categories of risk factors can be ranked in order of importance and criticality as follows: logical, physical, human factors, and organizational factors. survey of experienced cybersecurity managers and engineers. (2)
this study show that most security controls are used frequently and are important mechanisms to prevent and minimize potential risks.
The next step was to test the hypothesis about relationships between key risk factors using correlation coefficients.
The correlation coefficient is a statistical indicator of the probability of a relationship between two variables, measured on a quantitative scale, which allows you to answer the question of the degree and direction of the relationship between the values of these variables.
To choose the right method of correlation research, it is necessary to answer the question of whether the studied factors are normally distributed. Frequency histograms for key risk factors are presented in Appendix 2. An example of a histogram for factor Fact_21 is shown in the Figure 4. That is, 0: = 0, 1: ≠ 0, (3) where P is the distribution of our sample and P0 is a normal distribution.
Even though the plotted frequency histograms at first glance are quite symmetric and are well described by the parabolic curve for both tests, significance values less than .05 which means that the data do not have a normal distribution (Figure 5). So, the null hypothesis that the data is normally distributed was rejected. .01 < p ≤ .05 – low statistical significance (one star – *), .001 < p ≤ .01 – the average strength of statistical significance (two stars – **), p ≤ .001 – high statistical significance (three stars – ***).
Table 10 (Appendix 1) illustrates the relationship between key factors.
The correlation analysis revealed a moderate negative relationship of medium statistical significance between factors Factor_20 and Factor_8 – r-Spearman =-0.528 at p ≤ .01, as well as a moderate negative relationship of low statistical significance between factors Factor_14 and Factor_8 – r-Spearman =-0.415 at p ≤ .05.
Analyzing the results of correlation analysis, we can conclude that among the studied risk factors there is a moderate positive relationship of low statistical significance for the correlation of variables Factor_10 and Factor_11 – r-Spearman = 0.423 at p ≤ .05.
Thus, the obtained results indicate that risk factors are often interrelated and have complex impacts, and therefore require a comprehensive and multidisciplinary analysis, considering all possible factors and conditions.
Thus, this paper investigates the problem of identifying and assessing information security risks in complex, distributed, and large-scale information systems, and also builds a profile of key risk factors that can cause potential information security incidents in the physical and functional allocation of resources. The study examines the main risks of information security that can be identified during the construction and operation of a typical distributed information system designed to provide one or more types of information processes and provisioning information services. The result was a ranking of the main risk factors according to their importance and frequency in practice, as well as highlighting the most significant security controls.
Thus, the results of the study show that all risk factors in the life cycle of a modern distributed system are very important and require detailed analysis and consideration when building a profile of potential threats and assessing information security risks. The importance rating of the risk factors categories by nature can be given as follows (in order of importance): technological factors (logical and physical), human factors, organizational factors.
In particular, the study identified ten main risk factors for distributed information systems, which can be displayed as follows (in order of importance and criticality of potential consequences): Factor_21, Factor_20, Factor_6, Factor_10, Factor_11, Factor_12, Factor_33, Factor_27, Factor_14, Factor_8. Nearly all respondents ranked factors related to lack of cybersecurity policy, lack of protection mechanisms against network attacks, violations of authentication and session management, violations of access control, and use of components with known vulnerabilities as the most important. These factors should be identified in the process of assessing and managing information security risks and monitored in the future.
Analysis of the most common categories of risk management mechanisms and measures used in modern distributed systems has shown that most protection controls are used frequently and are important mechanisms for preventing and minimizing potential risks. The generalization of the survey responses, according to the main groups of information security controls of modern distributed information systems in terms of frequency and effectiveness of their use, showed that most of the respondents identified controls responsible for the proper and effective use of cryptography and public key infrastructure, logical and physical access control, operational security and compliance with information security policies as important and most common in practice.
The results of the study can be used by managers and information security engineers to assess the importance and probability of potential risks and further prevent and minimize their consequences, as well as build tools for identifying and analyzing the risks of distributed systems based on qualitative, quantitative and intelligent methods.
Table A1 Top Security Risks Factors of Modern Distributed Information Systems Based on Researchers 1 2 3 Category № Risk factors
Factor_1 Factor_2
Factor_3 )re Factor_4 aw Factor_5 fto Factor_6 l(s Factor_7 ica Factor_8 g o L
Insecure applications use Inadequate patch management API vulnerabilities and breaches Technical flaws and errors during system design Insufficient logging and monitoring Broken authentication and session management Unapproved third-party software use Use of unlicensed software solutions with undeclared capabilities 0-day vulnerabilities and errors associated with the development of information technology Broken access control3 Using outdated hardware and components with known vulnerabilities Servers and network appliances security misconfiguration Low reliability of the set of hardware and software components, lack of a recovery plan, and periodic backups Weak endpoints and network perimeter protection Unmanaged IoT and mobile devices The imperfection of the organizational structure of the information security, the need for frequent reconfiguration of the information security or its individual parts The possibility of information leakage and sensitive data exposure using technical channels Insufficient physical access control Unauthorized use of the organization's assets Lack of protection mechanisms against external network attacks Lack of a cybersecurity policy Non-compliance with the requirements of standards at the stage of design of the system Non-compliance with information security requirements during system exploitation Lack of control over information security incidents Lack of top management commitment support and involvement
Lack of security audits ) re Factor_14 a w Factor_15 d ra Factor_16 h ( l a c i s yh Factor_17 P
Factor_18 Factor_19 Factor_20 Factor_21 Factor_22 Factor_23 Factor_24 Factor_25
Factor_26 3 Lack of differentiation of user rights and controlled area access Factor_31 Factor_32 Factor_33 Factor_34 Factor_35 Factor_36 Factor_37 Factor_38 Factor_39 Factor_40 3 Lack of antivirus protection policy Weak potential to apply existing protection technologies Inconsistencies between the infrastructure and the adopted security measures The inability to provide the proper level of support and comprehensive development of security systems Actions of unreliable employees Unintentional mistakes of service personnel Privilege abuse The essential list of persons with access to protected information Lack of personnel awareness (especially about phishing/social engineering) Lack of information security training A severe shortage of cybersecurity professionals Insufficient passwords hygiene Personnel access to potentially dangerous objects in the external network
Data loss or theft controls lack 3
Description controls responsible for implementing and verifying compliance with information security policies controls responsible for the organizational component of information security measures and the distribution of responsibilities; creation of a management system for initiating and monitoring the implementation and operation of information security in the organization Personnel and controls designed to regulate the work of personnel human resources and contractors, identifying their responsibilities for security information security both at the stage of the working process and upon dismissal Asset management controls related to the inventory of company assets, classification of processed information, and media management Logical access controls responsible for restricting access to control information and information processing facilities, access control policy, rights management for authorized users to systems and applications Table A2 (continued) 1 2 3 Control_6 Cryptography controls responsible for the proper and effective use of cryptography and public key infrastructure (PKI) to protect the confidentiality, reliability, and integrity of information Control_7 Physical and controls related to the management and prevention of environmental unauthorized physical access, loss, damage, theft or security compromise of assets and interruption of the organization's activities, as well as the definition of safe zones, entry controls, equipment security, “clear desk” and “clear screen” policies Control_8 Operational a set of controls for ensuring the correct and secure security work of processing information means that combines such activity as change management, backup, monitoring, logging and activity logs management, tracking the installed software and detecting malicious software, monitoring and eliminating identified vulnerabilities Control_9 Communications controls related to network security, network services, security information transmission, and messaging Control_10 System acquisition, controls that define security requirements and development, and protection mechanisms in development and support maintenance processes Control_11 Supplier controls regarding relationships with third parties and relationships contractors, protecting the organization's valuable assets that are available to them and ensuring an agreed level of information security and service delivery under agreements with suppliers Control_12 Information controls related to incident management, events, and security incident information security vulnerabilities, reporting on management identified violations, defining responsibilities, response procedures, and collecting evidence Control_13 Information controls that are necessary to ensure business security aspects of continuity planning, verification and ongoing audit business continuity procedures, the availability of resources and management information processing facilities, the use of resiliency and reliability principles to ensure security Control_14 Compliance controls that require compliance with legal and contractual requirements to avoid breaches of statutory, regulatory, or contractual obligations related to information security, procedures for protecting intellectual property, personal data, and assessing information security at all stages of the life cycle Table A4 Testing the Hypothesis about the Relationship between Variables Using Spearman's Correlation Coefficient