К ВОПРОСУ О ФОРМАЛИЗАЦИИ ЗАДАЧИ РАНЖИРОВАНИЯ ТРЕБОВАНИЙ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ

Abstract

Listen

Translate article

The article is devoted to the issue of requirements fulfillment aimed at ensuring information security in an organization. The main contradiction of the subject area concerned is pointed out, which consists in the presence of a huge number of different variants of requirements fulfillment in the absence of a possibility to choose their correct and optimal order. The task of requirements ranking is set and the idea of the proposed solution is described in the form of seven provisions aimed at coordinated recording of heterogeneous requirements in a single notation, and an intuitive scheme of the idea is synthesized (with all seven provisions indicated on it).
 To represent the idea, the following entities are introduced: an object-organization and its elements to which requirements are imposed; generalized conditions for satisfying requirements that do not depend on the specifics of the organization; variations of sets of conditions that take into account a particular organization; basic conditions that check the presence/absence of elements 
 of the object and the values of their parameters; algorithms of activities in the organization to satisfy the conditions; priorities of requirements and resources needed by the algorithms. It is concluded that such formalization will lead organically to the algorithmic solution of the ranking problem and, eventually, to automation.
 The most suitable automated ways of solving the problem of ranking information security requirements – algorithmic application of combinatorial optimization and machine learning methods – are specified. Their high efficiency in comparison with «manual» methods used in modern information protection practice is predicted.
 The novelty, theoretical and practical significance of the obtained results are noted, as well as the prospect of further research – the construction of an analytical model of requirements fulfillment, which could be the basis of an appropriate method, followed by its program implementation and conducting of necessary experiments.