Risk management in software development in the field of information protection

Abstract

In the context of increasing digitalization of sea and river transport, the immersion of the entire transport infrastructure in the digital environment, the volume of information flows serving the transport process is increasing, and the requirements for information protection are increasing in conditions of an aggressive external information environment. In the digital environment, a software product must not only serve the document flow of transport chains, but also ensure its confidentiality. Automation of transport facilities (ships, platforms, berths, warehouses) management increases their potential vulnerability from unauthorized access to control systems; the latter must be taken into account in servicing programs, increasing their size (for example, there is a need to fragment coherent information blocks and their alternative routing). This, in turn, increases the risk of errors in the software products themselves and significantly complicates their structure. Risks of failures (including confidentiality violations) during the software operation that implements information exchange can entail significant material and reputational losses for the developer. If the developer is legally and functionally involved in the industry, such losses can and should be considered among the general range of risks in water transport. An important aspect of risk management, which until recently was practically not considered in a quantitative aspect within the framework of mathematical models, is the joint consideration of losses when a risk situation occurs and the developer’s costs associated with reducing the likelihood of such occurrences; the latter may entail a reduction in the total expected losses, formalized as the corresponding mathematical expectation. As a result, risk management can be formulated in terms of mathematical programming problems with different (discrete or continuous) sets of constraints and with different properties of objective functions.