Making decisions by an individual is an element of managing any process in society; therefore, theories of cognitive science are applicable in various fields, including information and cyber security systems. This study proposes the development of a cognitive model of “danger-risk” in the process of managing information risks in information and cyber security systems. Based on the analysis of scientific literature, the concepts of “cognitive modeling” and “cognitive map” are defined. The views of scholars on methods for creating cognitive maps and mechanisms for simulating problem situations are presented. The main tasks addressed within cognitive analysis and modeling are outlined, and the advantages and disadvantages of cognitive models are identified. In the second part of the study, the main stages of developing the cognitive model of “danger-risk” in the field of information and cyber security are considered: identification of complex situations and issues, construction of a cognitive map, modeling and verification of model adequacy, and dynamic situation analysis. A theoretical model of “danger-risk” is developed, and its elements are highlighted. A list of risk management concepts in information security is characterized, and cause-andeffect relationships between them are justified using SWOT analysis. As an example, for a specific information asset (a database), threats and vulnerabilities are identified, and the risk level for each connection is calculated as the product of the probability of each threat's realization and the probability of corresponding damages. The model of cognitive risk maps in information security is represented in a static form as an oriented graph, with a subsequent selection of methods for handling these risks.
The informational component is one of the
most valuable assets for any organization.
Information can be stolen, distorted, become
inaccessible, and lose its integrity and
confidentiality, all of which result in significant
material and reputational losses for the
enterprise. Every 39 seconds, a new attack
occurs somewhere on the internet, costing
trillions of dollars annually [
As a methodology for managing an
enterprise's information security system, a
risk-oriented approach is chosen. The
formation of the existing spectrum of
information risks during the activities of a
specific organization, the minimization of
these risks, and their transfer or avoidance
while continuously monitoring the risk
situation, is a crucial step in the organization’s
information security system [
On the other hand, the implementation and application of the information security risk management methodology require significant efforts and resources in constant process monitoring. This prompts researchers and information security specialists to seek optimal and effective risk management practices.
Information and cyber security is a complex
system with a lack of sufficient analytical data
for uncertainty removal and forecasting.
Therefore, most approaches rely on expert
assessment, fuzzy logic theory, and graph
theory [
Modeling various scenarios in information
and cyber security is the tool that allows risk
analysis for management and future
prediction. This is evident from the extensive
research in this direction. In scientific
development [
Information and cyber security are closely intertwined with human activity, allowing the integration of cognitive science theories into information protection-related developments. Cognitive science, or cognitology, is an interdisciplinary scientific direction that combines the theory of cognition, cognitive psychology, neurophysiology, cognitive linguistics, and artificial intelligence theory.
As claimed by researchers [
Cognitive Modeling
One of the contemporary trends in scientific
research is the cognitive approach, which is
being implemented in studies across various
fields. “The cognitive approach aims to
understand how people decode information
about reality and organize it to make decisions
or solve pressing tasks” [15, p. 198]. Notable
scientific works in this regard include research
by R. Axelrod [
Cognitive modeling involves representing a
complex problem situation of a given system in
a simplified form, typically in a graphical
format. Scientific developments in this field
began with the formation of cognitive maps, as
proposed by Robert Axelrod (1976) for the
analysis and decision-making in social
sciences. Axelrod’s cognitive maps are iconic
oriented graphs, with the principle of
operation as follows: the concepts used by the
decision-maker are presented as nodes, and
the cause-and-effect relationships between
these concepts are represented as edges. A
positive connection between node A and node
B means that an increase in A leads to an
increase in B, whereas a negative connection
between A and B implies that an increase in A
results in a decrease in B [
C1 C2 + +
C3 – – +
C4
C5
–
С1 С2 С3 С4 С5
С1 0 +1 +1 0 0
С2 0 0 +1 0 – 1
С3 0 0 0 – 1 +1
С4 0 0 0 0 0
С5 ( 0 0 0 – 1 0 )
Figure 2: Cognitive map in matrix form
Later, researcher Bart Kosko [
Dynamic
Generation of Evaluation of the scenario influence of one development in factor on others time
Analysis of scenario Overall situation development in stability time Search for Consequences of structural changes influence on system to obtain stable elements or changes structures like relationships A fuzzy cognitive map by Kosko, in addition to cause-and-effect relationships between factors, also denotes their weight on the edges, with values ranging from [–1; 1], thus determining the level of this influence (Fig. 3).
Today, there are various modifications of
cognitive maps, including iconic cognitive
maps, fuzzy cognitive maps by Kosko, modified
fuzzy cognitive maps by Kosko, fuzzy relational
cognitive maps, and others. They are all
characterized by different interpretations of
edge weights and factor values within the
cognitive map. Deterministic and
nondeterministic cognitive maps are
distinguished, and each of them includes
iconic, quantitative, qualitative, and fuzzy
cognitive maps [
+ 0.3
C1
C2
It’s worth noting that cognitive maps do not
provide an exact description of the entire
system under study but rather reflect the
subjective assessments of experts in a given
situation. They serve as a model for
representing their knowledge. As a drawback,
it should also be mentioned that solving
cognitive modeling tasks can be challenging,
hence the need for software resources,
especially with a library of information assets,
their vulnerabilities, and threats for more
effective monitoring of information security
risks.
2.2. Stages of Cognitive Modeling
In scientific literature, various stages, schemes,
and mechanisms for modeling a problem
situation based on a cognitive approach are
proposed. We favor the process of construction
outlined in the study [
Within the "threat-risk" model, it is considered that the existence of threats results in the formation of a set of risks to the object, each of which is characterized by the probability of its realization and a certain harm when the threat exploits the vulnerability of the object. graph, where
Let's denote 1̅ = { , ̅, } an oriented
= { } represents the set of factors (concepts); in this case, it’s the set of possible threats to a given information asset, vulnerabilities that the threat can exploit, and possible consequences in case of the threat's realization.
̅ = { } represents the set of edges reflecting cause-and-effect relationships between factors.
= {
} represents the set of weights on edges (strength of influence); in this case, = = , 0 ≤ ≤ 1, where degree of risk, is the probability of each threat's realization, and is the probability of corresponding damages, calculated based on expert assessment and using SWOT is the
Researchers propose scenario modeling in analysis. three main directions: • • •
Development of the situation occurs independently of the system (selfcontained).
Development of the situation occurs through programmed actions (direct task).
Synthesis of a set of influences that allowed achieving a specific change in the situation (inverse task). 3.1. Quality Risk Analysis using
SWOT Analysis Constructing a cognitive map can be done by a single individual making decisions based solely on their experience, or by a group of experts using information provided by the organization or through a questionnaire. Additionally, it is possible to obtain results by openly conducting surveys and polling participants in the process.
In our research, to build a fuzzy cognitive map, we propose identifying the system and influence weights using SWOT analysis after conducting brainstorming.
SWOT analysis is a research procedure
whose idea revolves around a comprehensive
description of strengths, weaknesses,
opportunities, and threats when developing an
organizational strategy. SWOT analysis serves
as the initial stage of organizational strategy
planning, serving as a starting point for a more
in-depth examination of issues related to
information security risks. It is relatively
straightforward to use and does not require
experienced experts to conduct it. A more
detailed procedure for conducting a SWOT
analysis for managing information and cyber
security risks is described in works [
As an example, let's select an information asset, such as the organization's database, and conduct the identification of threats and vulnerabilities for this asset (Table 3).
We will determine the risk level for each factor (Table 4) using the probability multiplication formula for independent events.
Integrity
damage to databases (intentional and unintentional) Data theft and falsification Lack of Equipment uninterrupte failure and d power loss of sources unsaved data
Vulnerabilit y Lack of database protection
Absence of access rights segregation
damage to databases (intentional and unintentional) Data theft and falsification
Using SWOT analysis, the organization’s strategy was determined (Table 5) regarding countering threats, taking into account the company’s weaknesses (vulnerabilities of the information asset).
The priority threat is the one with the most connections to weaknesses. After the comparison, the priority threat is “Data Loss.”
Let’s determine the degree of impact using cognitive maps. After identifying information characterizing the database security, we will construct a matrix of the strength of relationships between the concepts (Table 6). qi 0.246 due to the choice of a small number of factors scientists suggest finding its density (cluster coefficient) using the formula = 2 , where n is the total number of connections, N is the total number of concepts.
= 22 132 = 0,13.
It's obvious that the more connections, the higher the density, and thus, more opportunities for change. In our case, the density is a moderate value. This is expected (threats and vulnerabilities). 3.2. Fuzzy Cognitive Map for Situational Analysis of that requires protection, vulnerabilities, and threats were identified, relationships between them were
designed, and their influence strength was determined. We will construct a cognitive
map in the form of a weighted directed graph (Fig. 5).
C
4 C 3
C 5 C
2 0,1014
C
6 0,0533 0,04212 0,00294 0,0278
0,00224 0,0017 C 1 0,0272
C 7 0,02696 0,00724 0,00332 0,00177 0,0026
C
13 0,0082 0,0022
C
8 0,00277 0,00199
C
9 0,00193
C
10 C
11 0,00128 0,00099
C 12
This graph represents a scenario modeling the situation’s development without influencing the process. By comparing the obtained risk level with the standard outlined in the organization's Security Policy, the leader makes decisions regarding the treatment of these risks: minimize, transfer, prevent, or accept. In the next stage, various scenario modeling is carried out depending on the actions chosen by the leader and the company.
The proposed methodical approach to information management and using cyber security
risk modeling and SWOT analysis allows for prioritizing actions to ensure the
confidentiality, integrity, and availability of information. 5. Acknowledgments This research was tested in the educational process of Boris Grinchenko Kyiv University with students majoring in Cybersecurity and