An algorithm of information security residual risk assessment taking into account a protection mechanisms separation by types
Analyzing modern approaches to assessing the risk of information security threats, the authors conclude that most of these approaches do not consider protection mechanisms separation by types, which would allow a better analysis of the existing protection system in an enterprise. The presented algorithm takes into account such separation and considers each type with an emphasis on its features. Due to the absence of clear separation of protection mechanisms, it is proposed to divide them into two groups: technical and organizational. To calculate residual risk, the authors taken into account additional variables, such as a possibility of the correct operation of the protection mechanism and the possibility of overcoming the mechanism in threat materializing. Technical protection mechanisms reqiire taking into account the probability of transition to an inoperative state over time. Considering organizational measures, it is worth considering an expiration of its validity or its changing due to changing conditions. Such processes have random nature, therefore the mathematical apparatuses of the hidden Markov model and random Markov processes are used to determine their probabilities. The final indicator of residual risk is determined using an alternative mathematical model obtained after a full factorial experiment. This model allows obtaining more correct values as it considers input parameters at upper and lower levels. As a result of the algorithm implementation, the values of residual risks are determined taking into account counteraction to the threat of each type of protective measures, which allows identifying the disadvantages of the protection system more precisely.