Interpretation model of assessments boundary information security risks

Abstract

Amendments to the legislation of Ukraine allow building, implementing, and conducting certifications of information protection systems owned by the state, or the requirements for the protection of which are established by law. It is recommended to use the requirements and/or guidelines of international practices that provide for the use of a risk-oriented approach. Thus, the international standard ISO/IES 27001 implemented in Ukraine recommends choosing or developing a method for assessing information security risks. At the same time, the results of the analysis of open sources revealed the absence of models and methods for quantifying their limit values. By informational, we mean the risks associated with the possibility of losses as a result due to violations of the properties of confidentiality, integrity, availability of information. Therefore, the purpose of this article is to develop an interpretive model that will provide the limit values of information security risks. Their quantitative values could be used as criteria at the stage of formation requirements for a comprehensive information security system and / or information security management system. The basis for calculating the value of the risk limit value is the standard deviation of the uncollected profit for the period. If the profit exceeds the planned, then hypothetically during the analysis period there were no incidents that would affect resources. Information risks are a component of the organization's risks. According to the recommendations of ISO/IES 27005, where risk is the effect of uncertainty on the achievement of goals, and the effect is a positive or negative deviation from the expected, the hypothetically obtained standard deviation can be considered an assessment of the impact of information uncertainty of additive information resources on economic results. In addition, assessing the acceptable threshold of information risk of the organization. Thus, an interpretive model for estimating the marginal risks of information security and allowable losses on individual components of threats to the information properties as a formalization of the impact of information uncertainty on financial consequences. This made it possible to quantify these estimates based on available actual economic / cost indicators of information activity in the organization.