АНАЛИЗ ПОДХОДОВ К РАССЛЕДОВАНИЮ ИНЦИДЕНТОВ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ

Abstract

The article presents an analytical review of materials on the investigation of information security incidents. It considers the definition of the concept of an information security incident. Regulatory documents regulating activities related to information security incidents are provided and the main directions and approaches to handling incidents are identified. The author draws attention to the fact that concepts such as information security and cybersecurity are often used as synonyms. The concept of information security seems broader in relation to the concept of cybersecurity. Cybersecurity can be defined as one of the components of information security and is aimed at protecting against attacks in cyberspace. Consequently, the issue of investigating information security incidents should be considered in a broad sense, since information security incidents can occur not only within cyberspace. All activities to collect information about incidents, their prevention, containment and investigation should be aimed at the informatization object as a whole. The article outlines the main directions for further research of the issue. Particular attention is paid to the “human factor” issue in communication.