This paper describes the risk-oriented approach to the development of information security systems. The author suggests a concept-based formal model of security risk assessment and analysis for information technologies. It is suggested that the set of mean values of the subject activity integral effects, which determine the degree of its activity compliance with the purposes and regulatory requirements in conditions of information security threats, as the risk level indicator. It is concluded that the system element of information security risk analysis is a set of information, technical, organizational and socio-economic indicators for risk assessment at individual stages of analysis. It is demonstrated that the suggested concept-based approach can be specified in detail in the form of mathematical models.
The notion of risk is a key notion in the field of security in general and information security in
particular [
Characteristic features of the information security risk assessment include: • High dimensions and the resultant labor-intensiveness of the assessment process stemming from the large number of potential security threats and vulnerabilities in the protected information technologies. • Need to assess the risk at every stage of the information technology life cycle starting from the product definition to its intended use and retirement; • Need to assess the risk at various levels of the information technology management, including the risk management and information security audit.
The risk “deployment” process demonstrated in Figure 1 can be presented as the successive effect produced by security threats on: • The processes going on in the information system; • The processes of the subject’s (data owner’s) activity management; • The results of activity at the level of individual subjects and at the level of the activity field in general.
Relevant indicators are used at each of these risk “deployment” stages, for example: • Probability of the incident occurrence, information security indicators: confidentiality, integrity, availability; • Performance of the information system, ability of the information system to perform its tasks; • Potential damage of the subject that can be caused by any disruption in its control process; probability of the damage occurrence.
High dimensions and multiple levels of the risk analysis task explain the wide practical application of
qualitative (heuristic) methods used for its solution. However, the qualitative analysis methods do not
fully suit the existing situation in the IT field which is characterized by the high significance of
information infrastructure, intensive information confrontation, and high information security risks. An
important activity aimed to improve the risk analysis efficiency is the application of formal (qualitative)
methods of analysis based, in particular, on the results of formalization of various processes related to the
information security assurance [
Papers [
The formalism of individual processes associated with the information security assurance and specific
stages of the risk analysis serve as the basis for system research. Thus, papers [
The activity is regarded as a set of elementary processes. Evey i-th elementary process is characterized by a set of positive effects + expressing the degree to which a functional purpose of the process is achieved and a set of negative effects − expressing the resource-intensiveness of the process and side consequences (not relating to the functional purpose) associated with its implementation.
Each level of activity is a system of serial/parallel elementary processes (operations) formalized by the graph theory methods. The graph edge corresponds to elementary process and the neighboring vertices correspond to the set of input ⊲ and the set of output effects ⊳ of this process:
⊲ = +⊳, +⊳, … , −⊳, − ⊳, … , where indices , , … , , … ∊ ℕ, , , … , , … < are the indices of the processes , ,…, , ,…, whose output effects determine the output effect of the i-th process; ⊳ = { +, −} = ( ⊲, , ), where is the set of control parameters of the -th process, is the set of environmental parameters influencing the -th process, (∗) is the operation of transforming the set { ⊲, , } into the set ⊳.
The principle of activity decomposition into elementary processes implies the determination of activity nodes (time moments or process cycle events) where it is possible to identify uniquely the occurring effects meeting at least one of the following conditions: 4 "ISO/IEC/IEEE International Standard - Systems and software engineering -- Vocabulary," in ISO/IEC/IEEE 24765:2010(E) , vol., no., pp.1418, 15 Dec. 2010, doi: 10.1109/IEEESTD.2010.5733835.
indicators of the processes
indicators of the subjects
The effects are essential for further activity in accordance with its technology (also in order to form control actions);
The effects are essential in terms of compliance with regulatory requirements.
The accepted approach to presentation of the practical activity as a system of elementary processes is based on the following assumptions:
1) At the level of process operations (Table 1), each i-th elementary process is considered to be an indivisible entity;
2) The course and result of i-th elementary process depend only on the set of input effects and set of control parameters;
3) At other levels of activities, starting from the level of production processes, a certain sequence of processes of the preceding level to which assumptions 1)…2) apply is considered as the elementary process.
Presentation of practical activity as a system of elementary processes and effects is illustrated by Figure 2.
Thus, the activity is formalized by a sequence of states of the elementary process system in the effect space { +, −}. The states of one activity level can be nested into the states of another level by scalarizing the effects of the preceding level or operating the state vector (without transforming the effect vector of preceding level into the scalar effect of the next level. As the result, it becomes possible to perform successive generalization of the effects of individual process operations as far as the activity effects of the subject and industry on the whole. In the set of the subject’s (industry’s) activity effects, it is possible to distinguish the subset of integral effects Σ ⊂ { +, −} whose size is used to assess the degree of the activity compliance with the defined purposes and specified requirements.
The information processes underpinning the practical activity control take place in the context of information systems and, more broadly, in the context of the information infrastructure (Table 2).
Information operations are the procedural analogue of the process operation of practical activities in the information processes. They are performed by computation and communication information systems in compliance with preset algorithms and protocols and are aimed to solve the following tasks (refer to Figure 3):
Implementation of the abstract model of practical activity in the state space ;
Formation of control parameters ensuring the target path of the practical activity process in the state space considering the environmental conditions.
In the Figure you can see that is the state of practical activity processes, are the environmental parameters, are control parameters.
The values of control parameters = ( +, +, −, −, , ) are determined by such information process characteristics as: • Set of information operations + provided by the information process algorithms (protocols); • The probability that the i-th foreseen operation will be performed, + ∊ +; • Set of unforeseen (abnormal) operations − which can be performed in the information system under the influence of internal factors or environment; • The probability that the i-th unforeseen operation will be performed, − ∊ −; • Quality parameter (degree of completion) of the i-th operation ∊ ; • Duration of the i-th operation implementation ∊ = { +, −}.
The set of values of information process characteristics = { +, +, −, −, , } can be put into correspondence with the set of characteristics (properties) peculiar to the processed information including such classical properties as confidentiality, integrity, availability.
The standard procedural approach to the information process analysis suggests its presentation on several layers. Thus, the following layers are considered in computational information systems: application programming language, operating system, instruction set architecture, microarchitecture, digital logic layer. In communication information systems, such layers include the application layer, presentation layer, session layer, transport layer, network layer, channel layer, and physical layer. In databases, the conceptual, logical, and physical presentation layers are distinguished, each of which uses specific data presentation models.
The elementary information operation of the information process is considered in this model as a set including the input data , instruction for the input data processing, and the operation execution result : = { , , } (Figure 4).
Structurally, the information process is defined by the precedence relation (or consequence relation) specified on the set of information operations : i-th operation precedes the j-th operation , , if the result of the i-th operation execution is used as the input data for the j-th operation. In general, instruction of the operation can depend on the results of one or several preceding operations, which is formally specified by the influence relation in the set : i-th operation influences the j-the operation , , if the result of the i-th operation execution determines the instruction of the j-th operation.
The information processes are implemented using the information technology system described in Table 3.
This information technology system is a means of influencing the H characteristics of information processes by the subjects A determining its content. Subject А is considered a source of threat if its actions have the potential to cause an information security incident – occurrence of one or several unintended information operations out of the set − – or affect the effectiveness of foreseen operations implementation assessed in compliance with the indicators of set { , +}. It is convenient to show the correlation between the threats and the information technologies by which the threats can be implemented (Table 4) using a binary matrix ( , ): , = 1, if the j-th information technology can be used to implement the i-th threat; , = 0, if the j-th information technology cannot be used to implement the ith threat. information process parameters and, consequently, control parameters and effects of practical activity . The use of protective technologies is aimed to prevent the mean values of integral effects Σ from falling beyond the limits of permissible range ∗Σ in the presence of information security threats.
models; formal models of integrity and availability;
The suggested model briefly outlines the stages of the information security risk “deployment”. The set of mean values of the subject’s activity integral effects Σ, which determine the degree of its activity compliance with the purposes and regulatory requirements in conditions of information security threats is used as the risk level indicator. Using Σ as the risk level indicator allows taking into account both the extent of potential consequences of the information security threat occurrence and the probability of occurrence of such consequences. The risk is analyzed in accordance with the suggested model by solving successively the following tasks:
1) Analysis of threats to information security and development of a threat model. This task investigates the sources of threats, causes and probability of their occurrence; possibility and ways of the threat occurrence considering the applied information technologies are studied.
2) Analysis of the threat consequences by information indicators. This task investigates the impact of information security incidents on the efficiency of processes implemented by information technology, as well as on the quality of the information system operation on the whole.
3) Analysis of the threat occurrence consequences by organizational and technical indicators. This task includes the study of the effect the quality of information system operation produces on the control of automated processes in production and organizational activities.
4) Analysis of the threat consequences by social and economic indicators. This task is solved by investigating the influence of production and organizational activity effectiveness on integral indicators Σ characterizing the degree of the activity compliance with its purposes and regulatory requirements.
5) Development of an information security system. This task is performed to investigate the possibility, ways, and facilities for achieving admissible values ∗Σ by countering the threats to information security. Comparative assessment of the information security system development alternatives is carried out based on the complex indicator { ∗Σ, }, including the life cycle cost of the information security system.
The essential element of the information security risk analysis is the complex of information, technical, organizational, social, and economic indicators that ensure the risk evaluation at specific stages of analysis. 4. References