Методика кількісної оцінки ризиків із застосуванням онтології факторного аналізу інформаційних ризиків

Abstract

Unlike the already familiar scheme of threat development (for example, in the military sphere), the development of cyber threats follows a different logic. At the moment of detecting the influence of a threat, it can already entail significant negative consequences. At the same time, the efficiency of the cyber security system, as a rule, lags significantly behind the growth rates of material and non-material losses from the implementation of the threat.To neutralize cyber threats in the world practice, the theory of risk management, or risk management, is successfully used, which, unfortunately, is still rarely used in Ukrainian realities. According to current best cyber security practices, optimal security is achieved through an ongoing process of identification, risk assessment, and ongoing maintenance of security processes, combined with vulnerability remediation.The article is devoted to improving the methodology for quantitative risk assessment, which uses the methods of factor analysis of information risks (FAIR) by decomposition, the mathematical apparatus of simulation, and allows you to make more balanced and well-grounded decisions to prevent the onset of negative consequences in the event of the implementation of certain cybernetic threats. The given calculation algorithm, if implemented as a computer program, will help in the implementation of a proactive response to threats in the cyber security system in the Armed Forces of Ukraine.In the future, it is advisable to analyze the sources of obtaining the most relevant primary data necessary for the functioning of the simulation model and, on the basis of the experiments carried out, to find out the most optimal ways to increase the efficiency of the functioning of the cyber security system in the Armed Forces of Ukraine and to develop an appropriate software package for calculating the risk values according to the formulas given.