The concept of conflict theory is widely used in various sectors of society. This study examines the problem of using the main provisions of the theory of conflicts in the field of information security. With the development of information technologies, the risk of information conflicts is increasing, which can create threats to the integrity, availability, and confidentiality of information, which determines the relevance and importance of this research. The presented work is a continuation of developments describing the applied aspects of the theory of conflict theory in information security systems through the interaction of data streams in the “subjectsubject” perspective. It is proposed to analyze the problem at four levels: the level of the individual (criminal-user); business level (internal and/or external violator-company manager); state level (violators/hackers-state institutions, state officials); the level of international relations (states, a group of subjects/hackers-institutions and/or political leaders of another state). Each level is defined as a complex conflict system that has a corresponding structure and stages. It was determined that the main characteristics of an information conflict in cyberspace are: unlimited territory, globality, the problem of attribution, and the superiority of attack over defense. It is substantiated that information security systems have all the features of complex conflict systems, which implies the application of the mathematical theory of conflict, namely, the Lotka-Volterra “predator-predator” model and the conflict triad model. The innovative function of information conflict is determined. The concept of conflict theory is widely used in various sectors of society. This study examines the problem of using the main provisions of the theory of conflicts in the field of information security. With the development of information technologies, the risk of information conflicts is increasing, which can create threats to the integrity, availability, and confidentiality of information, which determines the relevance and importance of this research.
Our society, in the center of which is a person and his activities, is a complex dynamic system, which is characterized by many connections, interactions, and relations in different spheres and at different levels. Existence in such a system is impossible without disagreements, confrontations, contradictions, and conflicts.
More and more scientists are turning to theoretical and practical developments in conflict theory. This is connected not only with the problem of studying man as a conflicted creature, but also with the growing tension in various spheres of social interaction of the participants of the organization, the state, and the world.
There is no unequivocal opinion about the concept of “conflict”. In modern literature, there are more than a dozen different definitions of conflict. All of them have the right to exist because each emphasizes one or more characteristics of this multifaceted phenomenon.
For the term “conflict” we come across several
synonyms: clash of opposing interests, and views;
a sharp dispute; extreme aggravation of
contradictions, which leads to complications or
acute struggle [
At the same time, the authors of the study [
The transition of society to the information age
gave rise to innovative conflicts—informational.
Modern informational conflicts have significantly
transformed on both the micro and macro levels:
starting from communication in social networks
and ending with cyberespionage, cyberattacks,
cyberwars, and involvement of non-state actors in
relations in the international arena. With the
development of information technologies, the risk
of new conflicts that may threaten the integrity,
availability, and confidentiality of information
increases [
The beginning of the discussion of these
aspects of the analysis of information conflicts in
security systems was presented by us in the study
[
It is substantiated that it is advisable to consider the coverage of this problem through the interaction of the planes of the theory of conflict theory and the theory of information and cybernetic security in three perspectives: ● “subject—subject” or “person—person”, possibly “group of people—group of people”, “person—group of people”. ● “subject—object” or “man—machine”. ● “object—object” or “machine—machine”.
Within the scope of this article, it is intended to consider the applied aspects of the theory of conflict theory in information security systems through the interaction of data flows from the perspective of “subject—subject”. In particular, analyze the issues at four levels: 1. Personality level (criminal—user) 2. Business level (internal and/or external offender—company manager) 3. State level (violators/hackers—state institutions, state officials) 4. The level of international relations (states, a group of subjects/hackers—institutions and/or political leaders of another state).
Subject” Information Conflict
Conflict is a very complex system with
adaptive structures and evolutionary mechanisms.
It is a system made up of interconnected parts that,
as a whole, exhibit properties that cannot be easily
understood just by disassembling and analyzing
the properties of the individual components. A
deep understanding of conflicts requires, on the
one hand, a systems thinking approach, and on the
other, a combination of many social and scientific
disciplines [
Alfred
James Lotka and Vito Volterra in 1925 and 1926
[
In general, the model looks as follows: { where is the amount of information available to the user and interest to the attacker,
is the amount of information obtained by hacking, is the duration of the process, 1 is the probability that the volume of information of interest to the attacker is well Protected, the information, 2 is the probability that an attacker will obtain 3 is the probability that an attacker will not be able to obtain the information,
4 is the probability that an attacker has sufficient potential to breach the user’s protection.
However, the
presented
model is of a
generalized nature, since this information security
system is not isolated from others and is in a
complex relationship with them. To bring the
model closer to real data, various modifications
are used. Thus, work [
= ( 1, 2 , . . . , ),
= ( 1, 2 , . . . , ), > 1.
Therefore, the
values x and y can be represented not only by the volume of information but also by other characteristics of the security system.
The model can also be improved by introducing the delay time of the argument t, the value of which is determined by the method of experimental selection.
The next conflict system that can be modeled
in security systems is the conflict triad model [
Let’s apply the described model to the security system. Let us denote by P, R, Q substances that exist in a common space and interact with each other in a certain way. Then, in the conflict system of the “subject—subject” security system, we get the following subsystems at different levels (see Substances in the conflict triad of information security
Substance Substance
Interdependence between substances P, R, Q
[
Q – +
P – – + –
R substances (anthropogenic source of threats— security policy).
The conflict triad is a complex dynamic system since each of the three substances has an internal structure = ( 1, 2 , . . . , ),
= ( 1, 2 , . . . , ), = ( 1, 2 , . . . , ).
Also, all the formulas for the interaction of each substance with a pair of others are different from each other: P with a pair { , }, with a pair { , },
with a pair { , }.
The formulas defining the dynamic system of
the conflict triad are given in [
The nature of things in the world is such that any conflict process is endless. In each act, the 2.1.
The birth of the Internet in 1989 caused a rapid growth of computer equipment, in particular, personal. The use of the World Wide Web led to the creation of new interactions and relationships between people—virtual, the era of digital society began.
Persons,
relationships,
and
social
institutions are formed by both software and
hardware [
According to an analytical report [
about 12,000 and 60 times more than the corresponding system, usually two participants (however, there may be a third person—the customer). The duration of such a conflict is determined by the strength of the defenses and capabilities of the attacker. Table 2 presents the stages of this conflict.
Regulation of this conflict is possible at a latent stage, if the user has a high level of information protection, following the basic rules: password management; use of at least two-factor authentication; use of licensed antivirus programs; control over personal information transmitted over the Internet; avoiding the use of public Wi-Fi networks.
The direction of our research will further be directed to the analysis of possible conflict situations between the head of the company and a subordinate in the context of the existence of an information conflict, which causes a violation of the information protection system.
Information conflict in security systems “subject-subject” at the level of business “internal employee—manager” is defined as the result of an employee’s insider activity, which led to a violation of the security policy in the company’s information system.
Insider activity—directed actions of
motivated subjects who have legitimate access to
information assets and skills to obtain valuable
information, know the vulnerabilities of
information systems and business processes, to
cause material losses and/or reputational losses
of the organization [
As the 2022 Cost of Insider Threats: Global
Report reveals, insider threat incidents have risen
44% over the past two years, with costs per
incident up more than a third to $15.38 million;
the cost of credential theft to organizations
increased 65% from $2.79 million in 2020 to
$4.6 million at present; the time to contain an
insider threat incident increased from 77 days to
85 days, leading organizations to spend the most
on containment [
The authors [
High-class insiders see their malicious mission as their career decision. The portrait of such a violator is high-quality professional abilities, diligence, reliability, leadership, and dedication. Such insiders are very dangerous. The structure and stages of the informational conflict are different for each of these types. The description is presented in Table 3 and Table 4.
It should be noted that an insider can be an external actor, for example, a former employee, whose motive may be revenge for, in his opinion, unfair dismissal from work.
An information conflict is also possible if the insider activity was unintentional, but the loss of the company’s information data occurred. Moreover, the manager learned about this event after this incident. The structure of such a conflict does not contain a latent stage, since the informational conflict has occurred. The stage of the end of the conflict is the punishment of the employee (verbal or written penalty, material penalty, dismissal from work).
The conflict struggle is most often caused by a
primitive perception of reality, as if one of the parties
is capable of winning, and the other—is defeated.
There is some redistribution of the spectral
characteristics of the opposing sides in the conflict.
The victorious gain in one aspect means inevitable
loss, defeat, and loss in another. The essence of the
contradiction is transformed and appears again in the
future at another level of gradation of the complex
structure of interests [
In our opinion, this will make it possible to stop the informational conflict before the active stage.
The current stage is characterized by the
introduction of mixed systems and methods of
detecting insider threats [
A large business has the material resources to implement software products to detect insider threats, for example, the CHAMPION system (Columnar Hierarchical Autoassociative Memory Processing in Ontological Networks), small and medium-sized businesses practically do not deal with this issue. In this regard, we offer the following recommendations regarding the possible forecasting of conflicts in the company’s information security. This process is based on two components: 1. Software for determining the user’s computer activity, the main of which is: ● Role-based access policy. ● Restrictions on data transmission and copying. ● Using MPI (Microsoft Purview Insider or DLP (Digital Light Processing). 2. Psychological methods for personality profiling can be used: • “Big Five” test • Test “Ability to self-govern” • Individual psychological test.
As a result of processing the obtained results, if everything is satisfactory, then there is constant monitoring of the information system on the one hand and training with employees on the other. Otherwise, the security policy should be further reviewed and additional methods of detecting and countering insiders should be added. Fig. 2 presents the algorithm of this process.
Therefore, increasing investments in the
company’s information security will reduce the
likelihood of information conflicts. However,
companies stop at a level of rational investment
that is equal to or less than the expected losses
from a hack. This leads to a gap in investments
(Fig. 3) in the cyber defense of companies [
Rational Investment Level
Minimum
Risk Level Possible Approaches to information conflict resolution g n i r o t i n o m S I s u o u n i t n o C
Organization’s IS to determine activity
and their needs to perform official functions
transmission and copying.
Psychological and diagnostic testing of behavior 1. Individual psychological tests. 2. “Big five” test. 3. The “Ability to self-governance” test n o i t a r e p o o c d n a s g n i n i a r T Maximum Investment
Investment in information Security
Information conflict in security systems “subject-subject” at the level of the state “hackers—state institutions, state officials” is the process of resisting hacker attacks on the information systems of critical infrastructure objects of the state, as a result of which there is a possible disruption of the functioning of data about objects
It should be noted that most of the incidents are disclosed by the relevant state structures. Table 5 presents the structure of this conflict.
Combating online threats requires the state
to go beyond the whole government paradigm
and adopt a public-private partnership
approach, as the tools needed to respond are
often in the hands of others [
The relevance of the issue of information
conflict at the level of international relations is
confirmed by a large number of studies in the field
of politics, law, military affairs, and cyber security
[
Analysis of the literature made it possible to
identify the following features and characteristics
of information conflict in security systems:
● the geography of the conflict (in
traditional battles, the defender has an
advantage due to his knowledge of the terrain
and the direction of the attack, in the cyber
world these advantages disappear, since states
often do not know where the attack will come
from or even if an attack is happening [
An information conflict in security systems “subject-subject” at the international level “states, a group of subjects/hackers—institutions and/or political leaders of another state” is called the process of confrontation between subjects of international relations in cyberspace, where offensive means and techniques of subjects of one state are aimed at information systems of critical infrastructure objects of another state, as a result of which it is possible to disrupt the functioning of these objects.
The increase in the number of information conflicts at the international level is especially intensified during the period of armed conflicts between states. Thus, cyberattacks on the Ukrainian government and the military sector increased by 196% in the first three days of the Russian Federation’s war against Ukraine [18.
Summarizing the above, we have the following results: 1. The study of information conflicts from the point of view of information and cyber security is relevant and important since the relationships between participants in the virtual space are completely different. 2. When analyzing information conflicts in cyberspace, the following key issues should be considered: ● the problem of attribution (anonymity of the created cyber attack, it is difficult to distinguish different types of actors, including states, non-state groups, and individual hackers; the reward is a high level of information protection). ● the advantage of offense over defense (cyberspace encourages offensive strategies as opposed to defensive ones; attackers act without warning, looking for vulnerabilities, while cyber defense monitoring must be realtime and constant). ● unlimited territory.
● globality. 3. Effective prevention of cyber conflicts and their resolution requires public-private cooperation (involvement of security experts, IT technologies, members of the government, and scientists). 4. The creation of mathematical models in the process of analyzing information conflicts in cyber security systems will become an adequate tool for knowledge, description, and modeling of real phenomena in this field. 5. The theory of information conflicts in information and cyber security systems has an innovative character, strengthening the creation and development of new technologies for ensuring the integrity, availability, and confidentiality of information.