Methodology for assessing the maturity level of network security centers
DOI: 10.21293/1818-0442-2023-26-2-31-41
Abstract: The developed methodology for assessing the maturity level of Network Security Centers (NSCs) for information and tele-communication networks is presented. It is based on the appli-cation of the unified NSC maturity model and includes the fol-lowing steps: assessment initiation and preparatory activities; determining the possibility of an assessment and drawing up a work plan; assessment itself and formulating assessment find-ings; preparation of the assessment report and assessment com-pletion. This methodology is intended for specialists of a NSC owner organization, who conduct a self-assessment of its NSC maturity level, as well as specialists of specialized organizations recognized as competent to conduct a professional independent assessment of the maturity level of the NSC of a particular or-ganization.
Keywords: network security center, information and telecommunication network, maturity level, methodology for assessing the maturity level
For citation:
Veligodskiy S. S., Miloslavskaya N. G. Methodology for assessing the maturity level of network security centers. Doklady Tomskogo gosudarstvennogo universiteta sistem upravleniya i radioelektroniki, 2023, vol. 26, no. 2, pp. 31–41. DOI: 10.21293/1818-0442-2023-26-2-31-41
Authors and copyright holders:
- Veligodskiy S. S. , National Research Nuclear University MEPhI (Moscow, Russia)
- Miloslavskaya N. G. , National Research Nuclear University MEPhI (Moscow, Russia)
- Federal Law No. 187-FZ dated 26.07.2017. O bezopasnosti kriticheskoy informatsionnoy infrastruktury Rossiyskoy Federatsii [On the Security of the Critical Information Infrastructure of the Russian Federation]. 2017. Available at: http://publication.pravo.gov.ru/Document/View/0001201707260023, free. (Accessed: June 12, 2023) (in Russ.).
- Decree of the President of the Russian Federation No. 250 dated 01.05.2022 O dopolnitel'nykh merakh po obespecheniyu informatsionnoy bezopasnosti Rossiyskoy Federatsi» [On Additional Measures to Ensure the Information Security of the Russian Federation]. 2022. Avilable at: http://publication.pravo.gov.ru/Document/View/ 0001202205010023, free. (Accessed: June 12, 2023) (in Russ.).
- Miloslavskaya N.G. Nauchnyye osnovy postroyeniya tsentrov upravleniya setevoy bezopasnost'yu v informatsionno-telekommunikatsionnykh setyakh [Scientific Foundations for Building Network Security Centers in Information and Telecommunication Networks]. Moscow, Hot Line-Telecom, 2021. 431 p. (in Russ.).
- ISO/IEC/IEEE 15939:2017 Systems and Software Engineering – Measurement Process. 2017. Available at: https://www.iso.org/standard/71197.html, free (Accessed: June 12, 2023).
- GOST R ISO/IEC 27004–2021. Informatsionnyye tekhnologii. Metody i sredstva obespecheniya bezopasnosti. Menedzhment informatsionnoy bezopasnosti. Monitoring, otsenka zashchishchennosti, analiz i otsenivaniye [Information Technology. Security Techniques. Information Security Management. Monitoring, Measurement, Analysis and Evaluation]. Мoscow, Standartinform, 2021, 46 p. (in Russ.).
- Veligodskiy S.S., Miloslavskaya N.G. [Approach to Assessing Network Security Centers’ Maturity Level]. Highly Available Systems, 2023, vol. 19, no. 2, pp. 25–37. DOI: https://doi.org/10.18127/j20729472-202302-02 (in Russ.).
- Veligodskiy S.S., Miloslavskaya N.G. [Technologies Ensuring the Operation of Network Security Centers of Information and Telecommunication Networks and their Maturity Level Assessment]. Journal of Modern Digital Technologies, 2023, no. 15, pp. 30–41 (in Russ.).
- GOST R 57580.2–2018 Bezopasnost' finansovykh (bankovskikh) operatsiy. Zashchita informatsii finansovykh organizatsiy. Metodika otsenki sootvetstviya [Security of Financial (Banking) Operations. Information Protection of Financial Organizations. Conformity Assessment Methods]. Мoscow, Standartinform, 2018, 23 p. (in Russ.).
- STO BR IBBS-1.1–2007 Obespecheniye informatsionnoy bezopasnosti organizatsiy bankovskoy sistemy Rossiyskoy Federatsii. Audit informatsionnoy bezopasnosti [Information Security of Russian Banking Institutions. Information Security Audit]. Moscow, 2007, 14 p. (in Russ.).
- GOST R ISO/IEC 27007–2014. Informatsionnaya tekhnologiya. Metody i sredstva obespecheniya bezopasnosti. Rukovodstva po auditu sistem menedzhmenta informatsionnoy bezopasnosti [Information Technology. Security Techniques. Guidelines for Information Security Management Systems Auditing]. Мoscow, Standartinform, 2019, 24 p. (in Russ.).
- GOST R ISO 19011–2021. Otsenka sootvetstviya. Rukovodyashchiye ukazaniya po provedeniyu audita sistem menedzhmenta [Conformity Assessment. Guidelines for Auditing Management Systems]. Мoscow, Standartinform, 2021, 36 p. (in Russ.).
- Gardiner M. The Critical Incident Response Maturity Journey. EMC Corporation, 2013. Available at: http://docs.media.bitpipe.com/io_11x/io_115661/item_894499/Critical%20Incident%20Response%20Maturity.pdf, free (Accessed: June 12, 2023).
- SIM3: Security Incident Management Maturity Model. Open CSIRT Foundation, 2019. Available at: http://opencsirt.org/wp-content/uploads/2019/12/SIM3-mkXVIIIc.pdf (Accessed: June 12, 2023).
- Dorofee A., Ruefle R., Zajicek M., McIntire D., Alberts C., Perl S., Huth C.L., Walters P. Incident Management Capability Assessment. Software Engineering Institute of Carnegie Mellon University, 2018. Available at: https://resources.sei.cmu.edu/asset_files/TechnicalReport/2018_005_001_538866.pdf, free (Accessed: June 12, 2023).
- State of security operations. Hewlett-Packard, 2014. Available at: http://h41382.www4.hpe.com/gfs-shared/downloads-303.pdf, free (Accessed: June 12, 2023).
- Os V.R. SOC-CMM: Designing and Evaluating a Tool for Measurement of Capability Maturity in Security Operations Centers. Luleå University of Technology, 2016. Available at: http://www.diva-portal.org/smash/get/diva2:1033727/FULLTEXT02.pdf, free. (Accessed: June 12, 2023).
- Nettitude Blog: Cybersecurity Maturity Assessments Explained. Nettitude, 2020. Available at: https://blog.nettitude.com/cyber-maturity-assessments-explained-nettitude (Accessed: June 12, 2023).
- Crump J. Security Operations Center – Use Case Maturity Model /Cube (SOC-UCMM). 2018. Available at: https://www.jeffreydoncrump.com/post/security-operations-centre-soc-managed-security-service-provider-monitoring-content-maturity-cube (Accessed: June 12, 2023).
- The Security Operations Maturity Model: A Practical Guide to Assessing and Improving the Capabilities of Your Security Operations Center. LogRhythm, 2019. Available at: https://logrhythm.com/security-operations-maturity-model-white-paper/ (Accessed: June 12, 2023).
- GOST R ISO/IEC 33002–2017. Informatsionnyye tekhnologii. Otsenka protsessa. Trebovaniya k provedeniyu otsenki protsessa [Information Technology. Process Assessment. Requirements for Performing Process Assessment]. Мoscow, Standartinform, 2017. 16 p. (in Russ.).
- Audit informatsionnoy bezopasnosti [Information Security Audit]. Ed. A.P. Kurilo. Moscow: BDC-Press, 2006, 304 p. (in Russ.).
Last issue
Editorial office address
Executive Secretary of the Editor’s Office
Editor’s Office: 40 Lenina Prospect, Tomsk, 634050, Russia
Phone / Fax: + 7 (3822) 701-582
Executive Secretary of the Editor’s Office
Editor’s Office: 40 Lenina Prospect, Tomsk, 634050, Russia
Phone / Fax: + 7 (3822) 51-21-21 / 51-43-02
Subscription for updates
