System construction of cybersecurity vulnerabilities with Q-analysis

Abstract

Today, in order to assess potential cyber threats, it is necessary to conduct a comprehensive assessment of the vulnerabilities of the investigated system. To do this, it is necessary to describe the identified vulnerabilities and consider potential vulnerabilities. In addition, the relationship between system vulnerabilities must be properly assessed. The most common assumption is that all vulnerabilities are independent and are implemented either by random events or by malicious intent. The paper proposes a method that allows modeling the vulnerabilities of complex systems as a whole, taking into account their hidden connections. Q-analysis [2] was used to study the structure of the system of interconnected vulnerabilities that arise in the process of project implementation. An example of the application of Q-analysis methods is presented and an explanation of the nature and impact of some potential threats and their combinations is offered.