MODELING OF THE INFORMATION SYSTEM OF INFORMATION SECURITY INDEPENDENT AUDIT

Abstract

This article examines the condition of our country in the global information space in terms of protection against critical infrastructure cyberattacks. Accordingly, there is a need to develop and operate such an information system that would support the audit of information systems with all its components - subsystems. The proposed information system should be integrated, have a hierarchical structure. Such an information system makes it possible to allow the integration of both external and internal information, horizontal and vertical integration between systems with a different hierarchical structure. The process of modeling an information system takes place using ERwin's Case technology, which makes it possible to describe all the necessary processes with high accuracy, as a result of which the modeled system is defined as a set of interrelated functions and activities. Accordingly, the system is decomposed, which makes it possible to determine the model of this information system in the form of a hierarchical set of a number of subsystems, at each level of which some procedures are performed to solve local problems. Conceptual models of such subsystems provide visual modeling of all participants in the information system and existing information flows (both input and output, both internal and external influences). IDEF3 notation is also used in information system modeling processes, which in turn uses a graphical description of information flows, relationships between information processing processes and objects that are part of these processes. Thus, in this case, it is possible to describe and model the components of the decomposition diagram of the process of assessing the professional training of information security auditors. The information system of the specified subject area must first be a simulated system, ie the basic requirements and mechanisms for the implementation of an independent audit of information security at critical infrastructure facilities must be defined.