Currently, the most common approaches to assessing information security are verification and risk based. However, information security metrics in these approaches are not informative enough, since they consider only the objective aspects of security, completely ignoring the subjective ones. Therefore, they do not allow for the formulation of basic judgments about the level of information security of critical infrastructure objects. In this regard, there is a need to develop a methodological framework for assessing the information security of critical infrastructure objects, considering both objective and subjective aspects of security. The article proposes an approach to assessing information security based on the confidence criterion that the adopted security policy is implemented on a critical infrastructure object. Confidence assessment includes evaluating the trust in the information security of a critical infrastructure object, the quality of the trust assessment model, the background of individuals who conducted such an assessment, and the evaluation of knowledge regarding threats. The generalized desirability function of Harrington is used as a measure of confidence. The proposed approach is relatively simple to implement and can be used as a pilot for developing appropriate methodologies for assessing the information security of both critical infrastructure objects and organizations of various forms of ownership.
Recently, almost all spheres of human activity, society, and the state have become dependent on information, its quality, and relevance. Consequently, there has been a significant increase in cyberattacks on information resources, aiming to obtain crucial information or damage it. Critical infrastructure (CI) objects are most often subjected to these cyberattacks - these are information systems of state bodies, institutions, and companies. A disruption in their operation has a substantial negative impact on the social and economic spheres of the state, its defense capability, and national security [1]. Therefore, issues of information security (IS) are the cornerstone in the operation of such ob jects. As W. Churchill liked to say, "One has to pay for security, and pay dearly for its absence.
When assessing information security, the following main types of IS metrics are identified: implementation metrics, used to measure the degree to which the security policy is put into practice, and efficiency metrics, used to measure the performance of security services. These metrics form the basis of the most widespread current approaches to assessing information protection: verification-based and risk-oriented. The verification approach is based on comparing the activities and measures to ensure the IS of a CI object with the requirements of standards or guiding documents in the field of information security and protection. As a result, an assessment of the degree of IS compliance with the requirements of the set standards is formed. The risk-oriented approach is associated with risk assessment and management or risk management. It involves considering all possible factors threatening information security, the likelihood of their realization (attacks or incidents), and the value of protected information assets.
2023 Copyright for this paper by its authors. CEUR
ceur-ws.org
As a result, an assessment of the CI object's ability to effectively manage IS risks achieving its goals will be formed. However, these approaches share a common drawback: they are not informative enough, as they only consider objective aspects of security, completely ignoring the subjective ones. Therefore, they do not allow for a comprehensive assessment of the state of confidentiality, integrity, and availability of information and the overall IS level of the CI object.
In the ISO/IEC TR 15443-1:2005 standard [3], the concept of 'trust' is introduced for the first time as a subjective category of IT security, and methods to ensure trust are provided. These methods can be specific to a particular stage in the lifecycle of a trust object, in accordance with the ISO 9000 series standards, ISO/IEC 15408-1:2009 [4], and the SSE-CMM standard (ISO/IEC 21827:2008) [5]. In work [6], models for assessing trust in information security are proposed, as well as examples of organizing and using measures to ensure assurance and trust. However, the provided examples do not allow for their practical use in assessing IS. In [6], models for assessing assurance in information security are proposed, as well as examples of organizing and using guarantees and trust. Yet, the reviewed examples do not allow for their practical use in evaluating information security. The use of confidentiality as a subjective indicator of an acceptable level of information security is also unquestionable. Moreover, in [7-10], issues of group decision-making based on trust criteria are considered. In [11], an approach to assessing information security is proposed that considers both objective and subjective aspects of security, using measures to ensure assurance and trust. This article is a further development of this approach and addresses issues of accounting for the completeness of information when assessing the information security of critical infrastructure objects.
From an objective point of view, security can be determined by the state of its object, the presence or absence of certain properties, abilities, etc. From a subjective point of view, security is defined as a certain feeling, perception, awareness, or perception of it by a person. Moreover, it is the subjective interpretation of the concept of "safety" that dominates in everyday consciousness, as evidenced by the results of the study [11]: out of 1506 respondents to the question of how they most often understand "safety" 234 answered - as "calm", 185 - as "confidence" and 128 as "rest."
The safety assessment can be obtained by different methods. However, whatever method is used, such an assessment will be subjective, since the choice of threshold values of security indicators is subjective, expert assessments are subjective, and the assessment of IS risks is subjective. Thus, the object receives the status of "dangerous" or "safe" only because of human evaluative activities, which serves as another confirmation of the need to consider subjective aspects in defining the concept of "safety". The informational security of a critical infrastructure (CI) object, as a state of protection of the informational environment, directly depends on the security of its informational infrastructure. As practice shows, this infrastructure is the primary source of vulnerabilities and IS threats. As new information technologies emerge, so do new vulnerabilities and new attacks. It's evident that mistakes, vulnerabilities, and risks will always exist. Therefore, it's almost impossible to guarantee the security of a CI object's operation. In this situation, we can only assert with a certain degree of confidence that an organization implements (realizes) the adopted security policy. This, in turn, prompts the application of relevant technical and organizational security measures to mitigate vulnerabilities and threats, aiming to ensure a sufficiently acceptable level of trust in the CI object's IS.
It should be noted that the notions "trust" and "confidence" are not identical and are not interchangeable. From the standpoint of psychology, as noted in the standard [6], confidence in the CI object's IS from the point of view of an individual is associated with the belief that he has confidence in its information security, while trust is associated with the proven ability of an organization's information security system to ensure the fulfillment of its security goal. Thus, confidence is an expression of conviction obtained through an assessment of confidence. Trust is determined by the evidence obtained from the assessment of the object. Evidence, usually including an assurance argument, documentation, and other relevant work material, provides the basis for an assurance assertion that is based on the results of the design and security assessment activities.
Confidence is the subject of the individual's perception of the specific safety requirements and the information obtained from the assessment that the assessed item will function in accordance with the specified requirements. Confidence refers to knowledge of the criteria, method, assurance system, and assessment procedures used. At the same time, confidence is based on the knowledge that the dangers we know do not have channels of influence on us, or they are minimized (protection has been undertaken), and we know the capabilities of this protection, or the probability of possible dangers is negligible. Regarding unknown dangers, we have a system that can predict them or to identify them and adequately adapt to them. In addition, the reputation, qualifications, and experience of the assessors are also important factors in building confidence. As a result of individual perception, different people may have different degrees of confidence because of the use of an appropriate method of ensuring confidence, both by the individual and by the organization.
According to [6], it is important to differentiate between trust in accuracy (correctness) and trust in effectiveness. Trust in accuracy is related to the assessment of the compliance of the critical infrastructure object's information security with the requirements of standards or leading global practices in the field of information security and information protection. In contrast, confidence in effectiveness refers to the ability of security functions (processes) to withstand perceived or identified threats. Both correctness assurance and efficiency assurance are important characteristics, and neither is advantageous because both types of assurance operate on significant aspects of the object.
Moreover, in [6] it is noted: "If the security capabilities of an object take into account potential threats and these capabilities have not been analyzed regarding the establishment of accuracy and project implementation, then one cannot be confident in the object's success in countering an attack. Similarly, if an analysis has established the accuracy of the project and the correct implementation of the security capabilities of the object, and the project does not provide for corresponding security functions to counter probable threats, then one cannot be sure that the object will withstand these threats." Therefore, in order to gain overall trust, the object must be assessed for project correctness, implementation, and operation (element of correctness) and must have the appropriate security capabilities to counter identified threats (element of effectiveness)." That is, a combination of these trust measures is needed to gain overall trust in the information security of the critical infrastructure object, which will serve as the basis for our confidence that the organization is implementing the adopted security policy.
The most important purpose of an IS assessment of an CI object is to create information needs to improve it IS. In this case, the purpose of the IS assessment is to determine the degree of confidence with which the CI object has implemented the security policy. As noted, confidence in the organization's information security is based on:
• trust in information security, the quality of the trust assessment model and the background of the persons conducting the trust assessment.
• knowledge that known threats do not have channels of influence on business processes or they are minimized (protection has been undertaken) and we know the capabilities of this protection, or the probability of possible threats is negligible.
• knowledge that relatively unknown threats are available that can predict or detecting them.
For clarity, these factors can be represented by the following graph (Fig. 1). Here, the background refers to the reputation, qualifications, and experience of a specialist. Let's introduce the notation: is confidence in the IS.
is credence to IS. is trust in correctness. Сэ is confidence in efficiency;
is the quality of the confidence assessment procedures. is the quality of procedures for assessing confidence in correctness. Рэ is quality of procedures for assessing confidence in efficiency; is background of persons conducting trust assessment. is background of persons conducting the assessment of trust in correctness. Вэ is the background of persons conducting the assessment of the credibility of effectiveness; is knowledge of threats. is knowledge of the impact of known threats. is knowledge of forecasting and identifying new threats.
Then the formation of confidence in the CI object’s information security can be represented as a display
: ( , , , ) → , in which objects , , , , in turn, are mappings of the form: : ( , э) → : ( , э) → , : ( , э) → , : ( , ) → .
(
persons conducting the assessment of trust in correctness
Trust in information security
correctness Quality of trust assessment models
If we identify the mapping data with the corresponding tasks, then the assessment of an CI object’s information security consists in solving five interrelated and interdependent tasks: assessing confidence in the organization's information security, assessing confidence in information security, measuring the quality of trust assessment procedures, assessing the background of individuals, assessing trust and assessing knowledge regarding the impact known threats and forecasting and identifying new ones. At the same time, the main problem that arises when solving these problems is the choice of the appropriate indicator and the method for calculating it.
One of the basic principles that must be guided when choosing criteria for assessing information security is the unconditional reflection by the criterion of usefulness for the CI object in terms of confidentiality, integrity, and availability of information [12]. Therefore, it is proposed to use confidence as a criterion for assessing information security, since it is an expression of conviction that an CI object’s information security system provides these security services, and as an indicator of confidence - the generalized function of Harrington desirability [13]. This allows the use of a single universal psychophysical measurement scale, which establish a correspondence between natural values of indicators in physical scales and psychophysical parameters параметрами subjective linguistic assessments of the "desirability (utility)" of these values for a person. We will use the one-way constrained Harrington desirability function, which is given by: = ( − ( − н)), where н is the normalized value of the indicator, , is the desirability.
In this case, ′ the values are calculated by the formula:
) ,
)
′ = −2 + 7⋅( − (
( − where and are the lower and upper boundaries of the area of change of the indicator .
After calculating the desirability , they are convolved into a generalized indicator D a generalized desirability function. This function is given by the formula:
= √∏ =1 .
According to (
Assessment of confidence in the correctness of processes and protective measures. Confidence in the correctness of processes and protective measures is reduced to assessing the degree of their compliance with the requirements of the standard, which is taken as the standard ISO/IEC 27000:2009 [1]. This standard (as a family of standards) has been chosen as the base one because, in our opinion, firstly, it absorbed the requirements and recommendations of international standards and best world practices on the field of information security, and secondly, it contains methodological recommendations for assessing information security, which can be applied to organizations of various forms of ownership. If necessary, this standard can be supplemented by national standards in the field of information security, as well as the requirements and recommendations of industry regulatory documents on information security.
To assess the level of IS compliance with the requirements of this standard, group and private IS indicators are used. Group indicators of information security reflect the areas of ensuring the CI object’s information security, and private indicators - the requirements of this standard for each of the areas. With the help of private indicators, attributes of the information security processes that are different in nature are assessed, which makes it possible to assess the level of compliance with the requirements of this standard. An integral assessment of the fulfillment of the requirements of the standard [1] is formed from the assessments of the IS group indicators.
Let = { , | = 1, }be a set of areas of information security; and = { | = 1, } be the set
of requirements of the standard for the i-th area. We will measure the degree of fulfillment of the
requirements using the Harrington scale. As a result, private estimates of the correctness
(desirability) of the implementation of these requirements will be obtained. Then the group indicator
, reflecting the correctness of the implementation of the requirements for the i-th area of information
security, is calculated by the formula:
(
This assessment reflects the degree of confidence in the correctness of the implementation of processes and protective measures for ensuring the CI object’s IS in the requirements of the standard [1]. Assessment of confidence in the effectiveness of information security processes. Confidence in the effectiveness of information security processes is based on the requirements for the composition and maturity model of information technology processes, which are widely used in the field of information security. In [14,15] provides a comparative analysis of the most common and frequently used maturity models, namely: • Open Information Security Management Maturity Model (O-SIM3). • Process Capability Model (PCM). • Business Process Management Maturity Model (BPM MM).
• Community Cyber Security Maturity Model (CCSMM).
The analysis shows that none of the models considered fully reflects all the modern IS requirements for CI objects of various sizes and areas of activity. Therefore, the CI object must be selected and applied to its needs, and, possibly, developed its own maturity model with suitable metrics for it, using the considered models as a template. At the same time, the PCM model in comparison with others, firstly, has a recommendatory rather than descriptive character. Secondly, it is oriented on the IT infrastructure and, thirdly, it is recommended by the standard [2] in the banking sector.
This model will be used as a reference model for the maturity of information security processes. The PCM maturity model is a measure for assessing the completeness, adequacy, and effectiveness of information security management processes. This model defines six levels of maturity from zero to five. The level of maturity of IS processes is determined by how fully and consistently the organization's management is guided by IS principles, implements IS policies and requirements, uses the accumulated experience and improves information security management system.
We will assess the maturity level of information security processes according to the ISF (Information Security Forum) methodology, which PwC companies widely use to assess the maturity of information security processes in organizations. 21 information security processes are subject to assessment, which are described considering the most well-known international practices and accepted standards (ISO27000, COBIT5 for Information Security, SANS, NIST, etc.) (Table 1). We will assess the level of maturity of IS processes according to the following scale (Table 2).
This scale offers a way to assess "from initial to maximum", by absorbing the requirements of the previous level of maturity by the next. For example, a process meets the second level of maturity only if all the requirements for the first level are met.
Let = { | = 1,21}be the set of IS processes, and be the assessment of the maturity of the
ith process, and нis the normalized value of the assessment calculated according to (
And finally, the assessment of confidence in the organization's information security is determined
by the value of the function:
(
Name of the IB process
As follows from the above, the assessment of trust is the result of an examination. Therefore, the quality of the trust assessment model in this case depends on the extent to which the expert method and the procedure for its implementation ensure the combination of mathematical models and value judgments of experts to obtain a reliable result. Based on this, quality of model assessment can be represented by a tuple: < , > , where is the expert method, is the procedure for its implementation. We will evaluate these attributes on the Harrington scale in terms of their usefulness. Let , and э , э be estimates of the usefulness of the expert method and the procedure for its implementation, which were used to get С and Сэ, accordingly. Then the assessments and э quality of models for assessing confidence in correctness and efficiency are calculated by the formulas:
= √ ⋅ and э = √ э ⋅ э, and the quality of the IS trust assessment model according to the formula: = √ ⋅ э
We will also give an assessment of the background of individuals who have assessed confidence in information security using the Harrington scale. Let and э be a desirability of the persons conducting the assessment of trust in correctness and efficiency. Then the background assessment of the persons who assessed the confidence in information security can be obtained by the formula: = √ ⋅ э
It should be noted that to obtain more accurate assessments of the quality of the trust computation model for information security and the background of those conducting such calculations, a group expert evaluation is required. In this context, the approach discussed in [16] can be used to reconcile expert assessments.
Knowledge of threats (Z) can be characterized by the completeness and reliability of information (evidence) that, firstly, known threats do not have channels of influence on IS object or they are minimized (protection has been undertaken) and we know the capabilities of this protection, or is negligible the probability of possible threats (R). And second, that there are means capable of predicting or detecting new threats (F).
Evaluation of information completeness. The completeness of information relates to the main
informational dialectical contradiction between the need for complete knowledge about threats and the
lack of this knowledge. In socio-technical systems, the completeness of information is an indicator ∈
[0,1) characterizing the measure of its sufficiency for deciding. This is a very uncertain and relative
indicator since the completeness of information is evaluated solely in relation to a specific task. Given
the above, we will assess the completeness of the initial data by filtering by comparing the available
information and the “reference”, which is sufficient to assess knowledge about threats. Such
(
threats
Forms of implementation foreign intelligence
activities unintentionally intended
entities individuals
radio technical channels
channels of special influence by forming fields and signals
with a purpose acoustic chemical optical Compromising emanation destruction
of the protection
system violation of information
integrity unauthorized access masquerading as a registered user overcoming security measures to use information or impose false information
using embedded devices or programs and
rooting computer viruses by connecting to equipment and communication lines
This tree consists of elementary structures (Fig. 3), which define the morphology of the corresponding information headings ( ) with the required level of detail (ℎ ). Each detail, in turn, is a parent rubric.
For example, the heading Sources has a detail of the activities of foreign intelligence services, not intentional and intentional. In turn, detailing not intentional and intentional are headings with detailing individuals and legal entities. Then the headings (subheadings) of this tree are assigned the weights of their influence (importance) on the top-level elements. Further, the available information is compared with the morphological tree by assigning a Boolean parameter to its elements: = 1 if the i -th rubric (subcategory) is present in the source data and = 0 otherwise. Then, similarly to the procedure for synthesizing global priorities of the method of analysis of hierarchies, the convolution of the obtained estimates of the elements of the morphological tree is carried out. As a result, an estimate of the completeness of the initial information will be obtained.
Let the elements of the structure (Fig. 3) have the following parameters: = ( , ), ℎ = {( , )| = 1, }, where , and , are the weight coefficients and. Boolean values of the elements and ℎ , respectively. Then the result of the convolution of the estimates of this structure is the value that is taken ∗ = ∑ =1 ⋅ as a parameter of its parent element . This parameter, in fact, expresses the degree of informational completeness of the corresponding heading, considering the importance of its subheadings, and, as a result, is taken as an assessment of the completeness of the original information. Assessment of the reliability of information. Under the reliability of information, we mean its property to reflect the objective reality with the necessary accuracy. The criterion for reliable information is the absence of distorted or false data, and the probability of its truth is used as a measure of quantitative assessment. When assessing the reliability of information according to, we will use the Kent scheme [18], which gives a clear classification of information in terms of the degree of its reliability (Table 3).
Then, knowing the reliability of the information available regarding threats and its
completeness, using the Harrington scale, it is possible to determine the usefulness of this
knowledge as a factor in ensuring confidence. Let ,
be assessments of the reliability of
evidence of knowledge R and F also is an assessment of information’s density. Then estimates
, , can be obtained using formulas (
Finally, the degree of confidence with which an CI object has implemented a security policy
= 3√ ⋅ ⋅
= 4√ ⋅ ⋅ ⋅
(
Consider an example that illustrates the proposed approach to assessing an CI object’s information security. To ensure a comprehensive analysis and objectivity of assessments, it is advisable to involve heads of information security services in CI object as experts [19]. A. Assessment of confidence in the CI object’s information security. As noted, trust in information security is based on trust in the correct implementation of processes and protective measures and trust in the effectiveness of information security processes. The assessment of confidence in the correctness (correctness) of processes and protective measures will be given using group and private indicators of information security. The corresponding areas of information security (Table 4) are used as group indicators.
For each area of information security assurance, there is a corresponding list of specific evaluation
indicators. To reduce the volume of the article, we will consider, for example, only the 4th and 6th areas
of information security and the first 4 private indicators that correspond to these areas. The assessment
of indicators is carried out according to a methodology that includes questionnaires using the Harrington
scale, and group indicators are calculated using the formula (
As a result, the assessment of confidence in the correctness (correctness) of processes and protective
measures according to (
Private indicator evaluation 0,83 0,68 0,95 0,7 0,78 Indicator number
Assessment of confidence in the effectiveness of information security processes. Such an assessment is carried out for all processes presented in Table 3 on a scale (Table 4). The following evidence should be used for analysis [10]:
documentary evidence of the assessment of potential losses (damage) to the CI object’s business because of the impact (possible implementation) of information security threats.
documentary evidence of the choice of the risk minimization (treatment) option in relation to all risks assessed after the process has been completed.
documentary evidence of a decrease in the number of potential incidents caused by risks and identified ex post facto.
documentary evidence of an increase in the number of identified risks, the impact of which has been weakened.
Private indicators of information security when using cryptographic Э = 21√∏2=11 = 21√0,282 = 0,942 .
Thus, the assessment of confidence in the CI object’s information security is determined by
the value of the function (
= √0,81 ⋅ 0,942 = 0,874
B. Measuring the quality of the trust and background assessment model. According to clause 6.
The quality of the trust assessment model will be assessed from the point of view of the extent to
which the expert method and the procedure for its implementation ensure the combination of
mathematical models and value judgments of experts to obtain a reliable result. In this case, we
will use the Harrington scale. Let = 0.85, = 0.93 and э = 0.95, э = 0.93 be
estimates of the usefulness of the expert method and the procedure for its implementation for
obtaining reliable estimates of confidence С and Сэ, accordingly. Then, using formulas (
= √0.85 ⋅ 0.93 = 0.89, э = √0.95 ⋅ 0.93 = 0.94, = √0.89 ⋅ 0.94 = 0.91.
We will also give an assessment of the background of individuals who have assessed confidence in information security using the Harrington scale.
Let = 0.76 and э = 0.83 be the assessments of the background of the persons who
assessed the trust in correctness and efficiency. Then according to (
C. Assessment of knowledge regarding threats. Let = 81 and = 90 be estimates of the
reliability of evidence of knowledge R and F according to the Kent scale, =0.85 is the degree of
completeness of the available information. Assuming for confidence estimates in (
= 3√ ⋅ ⋅ = 3√0,98 ⋅ 0,99 ⋅ 0.98 = 0.98,
and according to formula (
= 4√ ⋅ ⋅ ⋅ = 4√0,87 ⋅ 0,91 ⋅ 0,79 ⋅ 0,98 = 0,88
Such confidence on the Harrington scale can be interpreted as “very high”.
A methodical approach to assessing the information security of an CI object by the criterion of confidence is proposed. The factors of confidence formation are considered, and the generalized Harrington function is proposed as its integral indicator. The assurance assessment includes an assessment of the CI object’s information security assurance, the quality of the assurance assessment model, the background of the individuals who conducted the assessment, and the threat knowledge assessment. In general, the considered approach can be used as a pilot for the development of appropriate methods for assessing the information security of CI objects of various forms of ownership, and the considered example clearly demonstrates its availability. 9. References