METHOD OF COMPREHENSIVE CYBERSECURITY RISKS ASSESSMENT IN DISTRIBUTED INFORMATION SYSTEMS
Dmytro Palko, Larysa Myrutenko · Cybersecurity Education Science Technique · 2024
Cybersecurity risk assessment and analysis is an important element for building an effective information security management system. The high complexity and scalability of the architecture of modern distributed systems, the heterogeneity of equipment and infrastructure, as well as constant changes in the configuration and scaling of the environment give rise to a number of problems related to the collection and analysis of information for risk assessment, the need for operational processing of large arrays of complex in structure and heterogeneous in nature data coming from differentiated security and monitoring systems, event logs, audit reports and other sources, as well as the lack of a single format for their presentation. The limitations of existing standards and methodologies in the dynamic conditions of modern DIS, their conceptual nature and the complexity of practical implementation and application require the development of flexible methodological and technological solutions for cyber risk analysis that would integrate the advantages of existing approaches, provide automation of calculations and take into account the dynamic aspects of distributed environment. The article presents a comprehensive adaptive method for quantitative assessment of cybersecurity risks in distributed information systems, which is relevant in dynamic conditions of complex multi-component and scalable DIS. The proposed method, integrating a metric-oriented approach based on the results of a complex of neural network models for assessing DIS infrastructure security indicators and compliance metrics for regulatory frameworks and leading standards, provides an opportunity to create a scalable and dynamic cyber risk management system that effectively responds to modern threats in DIS and open opportunities for the comprehensive implementation of intelligent information security management systems in risk management processes.