Вопросы организации экспертизы модели угроз

Abstract

Currently, there is a need to develop a threat model regulated by a number of regulatory documents for various information systems that are subject to protection in accordance with current legislation. The threat model itself is a document whose main purpose is to identify current threats to a particular system. However, there are different types of information systems, for each of which the task of compiling a threat model may have different resource intensity. Also, an important aspect is the correctness of the developed threat model, since there is a law on liability for offenses in the field of information protection. Based on this, there is a need to consider the features of building a threat model for different types of information systems in order to simplify its examination. The paper presents a structured algorithm for building a threat model with features for different types of information systems.