Разработка системы контроля инцидентов информационной безопасности

Abstract

The purpose of this work is to develop an information security incident control sys-tem that meets the requirements for recorded information and information security incidents. the article raises the question of the need to create a system that will allow you to control information security incidents. Evaluation of existing solutions on the market, formation of requirements for the system. Selection and justification of technologies during development. After registering an incident, it is possible to interact with other network nodes, block the source IP address on the ME web server (iptables), close the network port, block domains on the proxy server. The functionality of viewing this information in the system web interface is also implemented. The article describes and substantiates the need to create and implement such a system in the information network. To achieve this goal, an analysis of the market for similar systems, as well as problems in their maintenance, was carried out. Based on the analysis, a technical task was developed with the subsequent implementation of the program code. The system was then tested and several work scenarios were implemented. In the work, an analysis of methodological documents related to information security incidents was made, a technical task was developed, a program code was implemented, and testing was carried out. As a result, the software "Information Security Incident Control System" was developed.