Proceedings of TUSUR University / Archive / Issue of Journal № 4, t. 27, 2024 / Adaptive Information Security Management Models in the Process of Developing a State Information System

Adaptive Information Security Management Models in the Process of Developing a State Information System

DOI: 10.21293/1818-0442-2024-27-4-61-73

Download article in PDF format

JATS xml

Abstract: The article considers problematic issues of developing adaptive control models for information security in a state information system during the creation of its security system. These models aim to take into account changes in the representation formats of protected information, the dynamic conditions of its processing, and factors posing a threat of leakage through technical channels. Descriptive models of the investigated processes have been developed. Feasibility of considering these changes and conditions is substantiated through an adaptive information security management system established on a centralized principle, providing two-level control by reinforcing security measures in accordance with changes in the composition of the protected object, internal and external factors characterizing the dynamics of the system's operation, and approaches to addressing problematic issues in assessing its effectiveness. To calculate performance evaluation metrics for information security management during the stages of creating a secure information system, considering the time factor and various logical control conditions, the application of composite Petri-Markov nets is proposed. Control cycle flowcharts for two levels has been developed, which are considered as the basis for constructing composite Petri-Markov net graphs.

Keywords: secure information system, adaptive information security management system, information leakage threat, conditions and factors, effectiveness of information security management

For citation:
Avsentiev O. S., Tomilova E. A. Adaptive Information Security Management Models in the Process of Developing a State Information System. Doklady Tomskogo gosudarstvennogo universiteta sistem upravleniya i radioelektroniki, 2024, vol. 27, no. 4, pp. 61–73. DOI: 10.21293/1818-0442-2024-27-4-61-73

Authors and copyright holders:

Avsentiev O. S. , Voronezh Institute of the Ministry of Internal Affairs of the Russian Federation (Voronezh, Russia)
Tomilova E. A. , Voronezh Institute of the Ministry of Internal Affairs of the Russian Federation (Voronezh, Russia)

1. On the approval of requirements for protecting nonstate secret information in state information systems [Electronic resource]. FSTEC order of Russia dated 11 February 2013, no. 17. Available at: https://base.garant.ru/70391358, free (Accessed: 22.12.2024) (in Russ.).
2. GOST P 51583. [Information security. Procedure for creating automated systems in a secure configuration. General provisions]. M., Standartinform, 2014, 15 р. (in Russ.).
3. GOST 34.601–90. [Information technology. Set of standards for automated systems. Automated systems: stages of creation]. M., Standartinform, 2009, 6 р. (in Russ.).
4. Avsentiev O.S., Butov V.V., Valde A.G. [Models for justifying organizational and technical support for measures to create SIS informatization objects]. Works of communication institutions. 2024, vol. 10, no. 5, pp. 93–108. DOI: 10.31854/1813-324X-2024-10-5-92-107 (in Russ.).
5. Avsentiev O.S., Avsentiev A.O, Krugov A.G., Yazov Yu.K. Simulation of processes to protect information of informatization objects against leakage through technical channels using an apparatus of Petri–Markov nets. Bulletin of the South Ural State University. Ser. Mathematical Modelling, Programming & Computer Software (Bulletin SUSU MMCS), 2021, vol. 14, no. 4, pp. 46–62.
6. Ozhiganova M.I., Kalyta A.O., Tishchenko E.N. [Construction of adaptive information security systems]. NBI technology. 2019, vol. 13, no. 4, pp. 12–21. DOI: 10.15688/NBIT.jvolsu.2019.4.2 (in Russ.).
7. Zhmurko D.Ju. [Concept, essence and classification of adaptive management systems with organizational complexity]. Scientific journal of KubaGAU, 2013, no. 90 (06) [Electronic resource]. Available at: https://cyberleninka.ru/article/n/ponyatie-suschnost-i-klassifikatsiya-adaptivnogo-upravleniyasistemami-s-organizatsionnoy-slozhnostyu/viewer, free (Accessed: December 20.12.2024) (in Russ.).
8. The Grand Encyclopaedic Dictionary. 2nd ed., rev. and exp. M.: The Great Russian Encyclopedia; SPb.: Norinth, 2002, 1456 (in Russ.).
9. Guidance document. Methodology for assessing information security threats. Approved by CCFTU Russia 5 February 2021 (in Russ.).
10. Yazov Y.Q., Solovyev S.V. Methodology for evaluating effectiveness of information protection in information systems from unauthorized access: monograph. Saint-Petersburg: Science-intensive technologies, 2023, 258 p. (in Russ.).
11. Special requirements and recommendations for the technical protection of confidential information (TPC-K), Approved by Order of the State Technical Commission of Russia dated 30.08.2002 no. 282 [Electronic resource]. Available at: http://www.rfcmd.ru/sphider/docs/InfoSec/RD_FSTEK, free (Accessed: 25.12.2024) (in Russ.).
12. Avsentiev A.O., Ponomarenko S.V., Rojkov A.G. Verbal model of the technical channel for information leakage due to side electromagnetic radiation at the data processing facilities. Bulletin of the Voronezh Institute of the FSIN of Russia. 2020, no. 1, pp. 9–21 (in Russ.).
13. Korshunov Y.M. Mathematical foundations of cybernetics: study, a manual for universities. 2nd ed., rev. and exp. M.: Energy, 1980, 424 p. (in Russ.).
14. GOST R 50922–2006. [Information protection. Basic terms and definitions]. M., Standartinform, 2008. 8 р. (in Russ.).
15. Zabrutin V.S. et al. Security System: Training manual. Voronezh, Voronezh Institute of the Ministry of Internal Affairs of Russia, 2012. 282 p. (in Russ.).
16. Yazov Y.K., Avsentiev A.O. Problematic issues of management of information protection against leakage through technical channels using multi-agent systems. Cybersecurity, 2024, no. 6 (64), pp. 85–97. DOI: 10.21681/2311-3456-2024-Z-XX-YY (in Russ.).