Ранжування загроз для визначення витрат на забезпечення захищеності системи захисту інформації на основі теорії нечітких відношень

Abstract

For the construction and effective functioning of the information protection system it is necessary to analyze the possible threats to the level of their impact on the studied system and determine the allowable costs to ensure its security. The vast majority of this issue is solved using statistical analysis methods, which require consideration of a significant amount of information, complex calculations and take a long time to process. Therefore, the paper proposes the ranking of threats to the information security system using the theory of fuzzy relations. The initial information about the system is given in the form of a vague relationship of the impact of threats on non-compliance with the established criteria. Based on the defined ranks, the set of threats to the information protection system is divided into classes that do not intersect and are equivalent in weight. The division into classes is carried out using a transitive closure of the fuzzy similarity relationship and makes it possible to build a clear plan for the protection of the information space, taking into account the degree of influence of each class of threats. A decomposition tree for equivalence classes is also constructed, which clearly represents the number of classes and the list of threats belonging to this class at each level. To ensure the security of the information security system, it is proposed to distribute the eligible costs in proportional equivalence to the ranks of threats. This will promote the rational use of resources and tools to prevent, eliminate or reduce the impact of probable threats to the information security system, provide a balance between the level of information risk and the eligible costs of information security measures.