Objects Of Critical Information Infrastructure Research Articles

THE SIGNIFICANCE OF LEGAL REGULATION IN ENSURING CYBER SECURITY IN THE CONDITIONS OF WAR: EXPERIENCE FOR UKRAINE

Introduction. In the vast majority of countries, there is a constant trend towards a significant increase in the number and expansion of the spectrum of cyber-attacks with the aim of violating the confidentiality, integrity and availability of state information resources, in particular those distributed on the Internet and objects of critical information infrastructure. Summary of main results. The large-scale deployment of a hybrid war against our state seriously affects all aspects of social life. To a large extent, the strategic success of countering the challenges of hybrid warfare depends on the effective and quality of the legal response. Ensuring an adequate level of cyber security is difficult to imagine without clearly planned joint actions and measures developed by responsible entities, which must be synchronized and implemented according to a single strategic plan and development vector of the national cyber security system of a declarative nature. That is why cyber security in most countries of the world is recognized as an important component of national security, the provision of which is impossible without the formation and functioning of a national system in the field of cyber security, which is based on such principles as respect for the principles and norms of international law, protection of fundamental values defined by current legislation, protection national interests in cyberspace. It is emphasized that the state's national security largely depends on the state of cyber security. It has been proven that hybrid war significantly increases the impact of cyber threats on Ukrainian society and actualizes the danger of targeted cyber attacks as a tool of aggression against our state in the context of global trends regarding threats in cyberspace. Conclusions. In the process of conducting the research, we formulated conclusions in which special attention was paid to the peculiarities of the current state of functioning of the legislation on cyber security and considered promising directions for its improvement in the future, which, in turn, will become the basis for improving the administrative and legal regulation of cyber security in Ukraine.

АНАЛИЗ СИСТЕМ ВЗАИМОДЕЙСТВУЮЩИХ ОБЪЕКТОВ КРИТИЧЕСКОЙ ИНФОРМАЦИОННОЙ ИНФРАСТРУКТУРЫ НА ПРЕДМЕТ ЦЕЛОСТНОСТИ И ЭФФЕКТИВНОСТИ ИХ ФУНКЦИОНИРОВАНИЯ

In the course of the development of information systems, their growth and scale, the problem of infrastructural destructivism is becoming more acute. This phenomenon adversely affects the performance of the system, including damage to its security. To solve this problem, the article considers models of systems of interacting objects from the point of view of the impact of vulnerabilities of infrastructural origin on them, taking into account the categories of importance of objects of critical information infrastructure. And since infrastructural destructivism develops at all stages of the life cycle of systems of interacting objects, a study of its manifestation in time has been carried out. The main purpose of this study was to study the synergy of the interaction of objects in both static and dynamic modes. In the course of the study, the system of interacting of critical information infrastructure objects was considered at the structural level. At the same time, the synergetic dependence of the functional development of the infrastructure on possible vulnerabilities in it was investigated. Various variants of combinations of categories of significance of interacting of critical information infrastructure objects were considered. This made it possible to analyze the types of possible interactions and the levels of their impact 
 on the system as a whole. For example, interacting objects within the same system can exchange the impact of vulnerabilities, or conversely, contain vulnerabilities of such a kind that the mutual negative effect of them will be reduced to zero. The article presents the results of research on these issues.

Некоторые вопросы управления рисками реализации угроз безопасности информации

The article proposes an approach to assessing the risks of information security of automated technological process control systems, state information systems, municipal information systems, personal data information systems and critical information infrastructure facilities based on the requirements of the legislation of the Russian Federation in the field of protection of these types of information systems, the draft of State Standard R ISO/IEC 27005, planned to be adopted in the near future, and standards for risk assessment within the framework of processes in the life cycle State Standards 59329-59357 published in 2021. These standards are based on State Standard R 57193-2016, which describes the life cycle processes of human-made systems. The problem of processing residual risk in relation to unacceptable risks was considered, after the analysis of which another principle of safety management was proposed. A methodology for assessing confidence in the risk management system was obtained, with the help of which it is necessary to build a risk management system at the objects of critical information infrastructure.

Application of Sentiment Analysis to Prevent Cyberattacks on Objects of Critical Information Infrastructure

The article addresses the pressing issue of ensuring cyber security for critical information infrastructure, which is associated with the development of modern information technologies and the increased potential for cyber attacks from criminal groups and potential adversary state entities. An analysis of the scientific literature indicates the necessity of preventive measures and scientific research, which involve monitoring the cyberspace. The application of sentiment analysis is proposed to detect the emotional sentiment towards critical information infrastructure objects. Following a defined algorithm, a sentiment analysis model is constructed based on an artificial neural network using open-source Python programming language libraries. The model's distinguishing feature is the consideration of emoticons to determine the intensification of emotional attitudes towards conducting cyber attacks on critical information infrastructure objects. A dataset related to cyber attacks from social media platforms such as Twitter and Instagram is collected to train the neural network. The results of training and testing the neural network provide grounds to assert that the network's accuracy of 0.7852 is relatively high, enabling its application by cyber reconnaissance units for early detection of cyber threats to critical infrastructure objects in combination with other tools.

Analysis of terminology for identifying the risks of ensuring security and sustainability of critical information infrastructure in Ukraine

The article is devoted to the definition of the concept of risk in the context of ensuring safety and sustainability of critical information infrastructure in Ukraine. It has been specified that, in general, the risks, which may arise and affect critical information infrastructure objects of Ukraine, are a highly specialized subject matter of research searches. Therefore, there is no clear identification of the term «risk» in the context of the proposed public relations at the scientific level. It has been emphasized that the legislative doctrine also does not define its content and essence.
 The general theoretical and legal definition of the term «risk» has been analyzed. An attempt to differentiate its characteristics as a distinct legal phenomenon from related legal categories has been made.
 It has been summarized that the category of risk in the context of ensuring safety and sustainability of critical information infrastructure in Ukraine is a is a form of manifestation of danger caused by the presence of phenomena, factors, circumstances, events, etc., which can potentially have negative consequences on the course of public relations, functionality of objects or specific legally protected interests in this sphere. In addition, we have clarified that the category of threat should also be understood as a form of manifestation of danger, which is due to the presence of phenomena, factors, circumstances, events, etc., but only those that will damage safety and sustainability of critical information infrastructure in Ukraine in the future (in particular, if it is not neutralized, it will become a risk).
 It has been summarized that to ensure that potential risks in the field of critical information infrastructure protection do not become an actual problem, the State, in formulating its policy in this area, should clearly define, i.e. establish at the legislative level what is a risk to critical infrastructure in general and for information one – in particular. This is necessary to develop clear methodologies for monitoring and forecasting certain risks in the future to avoid their negative effects.

Legal support of cyber security of critical infrastructure objects

The article highlights the issue of legal support of cyber security of critical infrastructure objects. The conceptual apparatus in this area is considered. It contains an analysis of the current legislation of Ukraine in the field of cyber security. The project of the Law of Ukraine “On Amendments to Some Laws of Ukraine Regarding Urgent Measures to Strengthen Cybersecurity Capacities of State Information Resources and Critical Information Infrastructure Objects” is analyzed in the context of optimizing Ukrainian legislation in the field of cyber security. The expediency of applying a comprehensive approach to ensuring cyber security of critical information infrastructure objects has been determined. A proposal has been introduced to improve the legislation of Ukraine in the field of cybersecurity.

Cybersecurity of Critical Infrastructure Facilities

Relevance. The cybersecurity of information systems and services is becoming one of the important criteria for the quality of services and production of goods in modern society, just like the stability and speed of data transfer. Developers of software products and applications are concerned about the increase in the number of attacks on their systems, the increase in the theft of information and assets. The confrontation between Russia and NATO countries has intensified the growth of geopolitical threats and hacker intrusions into the information system of Russia with the aim of destabilizing and deactivating it. At the same time, Rostelecom-Solar noted that hackers are especially attracted to the critical infrastructure of the Russian economy. The purpose of the study was to evaluate modern technologies for protecting digital services used by companies and to identify new approaches to strengthening security systems. Objectives. The following tasks were set and consistently solved in the article: to assess the current trends in the transformation of information systems, as well as objects of critical information infrastructure in the light of the increasing attacks of hackers; propose a new approach to solving cybersecurity problems. Methodology. The methods of graphical, horizontal and logical analysis, generalization and systematization of data were used in the work. Results. Based on a general review of technologies for protecting critical infrastructure, both from the side of the state and from the side of business, it was concluded that it is necessary to form a triad of visibility of vulnerabilities. Conclusions. The article considers the directions of restructuring the entire cyber industry and the formation of a new vector for the development of the digital world in the context of changing geopolitical confrontations between developed powers. It is concluded that it is necessary to change the paradigm of the technology market in the direction of transferring all programs to Russian technologies and intensifying their promotion to the EAEU countries, which will allow building a new Eurasian IT market under the guidance of the Russian Federation.

Actual Problems of Qualification of Unlawful Impact on the Critical Information Infrastructure of the Russian Federation

Relevance. Protection of objects of critical information infrastructure is an urgent task of ensuring the information security of the state. This problem acquired particular significance during the period of the special military operation in Ukraine - during this time the number of computer attacks on the domestic information infrastructure has increased many times over. For several years, the application of Art. 274.1 of the Criminal Code of the Russian Federation is characterized by consistent growth. The study of judicial and investigative practice indicates the presence of legal and technical shortcomings of the norm and problems associated with its application.The purpose is to obtain new scientific knowledge about the implementation of the mechanism of criminal law protection of the critical information infrastructure of the Russian Federation, to substantiate proposals aimed at overcoming the difficulties that arise in the application Art. 274.1 of the Criminal Code of the Russian Federation.Objectives: to identify the problems of qualifying unlawful impact on critical information infrastructure facilities, to formulate proposals for improving domestic criminal legislation and law enforcement.Methodology. The methodological base of the research is made up of general scientific and particular scientific methods of cognition of reality, such as analysis, synthesis, induction, formal-legal, abstract-logical and others.Results. The study analyzed data from judicial statistics, law enforcement practice in cases of unlawful impact on the critical information infrastructure of the Russian Federation, studied doctrinal sources and analytical materials.Conclusions. The following provisions are formulated and substantiated in the work: 1) at the moment, the main direction of implementation Art. 274.1 of the Criminal Code of the Russian Federation is its application in cases of violation of the rules for the operation of computer information storage facilities by employees of companies providing services in the field of communications (telecom operators); 2) at the level of judicial and investigative practice, there is a discrepancy in the interpretation of socially dangerous consequences in the form of harm to an object of the critical information infrastructure of the Russian Federation.; 3) it should be recognized as erroneous in practice the decision to qualify the deed under Part 1 of Art. 274.1 of the Criminal Code of the Russian Federation in situations

УСТОЙЧИВОСТЬ ТЕХНОЛОГИЧЕСКИХ ПРОЦЕССОВ В АСПЕКТЕ БЕЗОПАСНОСТИ КРИТИЧЕСКОЙ ИНФОРМАЦИОННОЙ ИНФРАСТРУКТУРЫ

The purpose of the paper is to study the sustainability of technological processes in the aspect of the security of critical information infrastructure (CII). Cybercrime today brings attackers an income (affecting critical information infrastructure objects) of about $1.5 trillion a year, which means that the security of critical information infrastructure is still requiring due attention. Currently, there is no generally accepted approach to conducting such an assessment and its definition remains an urgent problem. It is also important to understand that the stability of technological (including significant, critical) processes does not always ensure their safety (management safety), as well as ensuring safety does not ensure the execution of technological processes. The object of the study is the objects of the CII. The subject of the study is technological processes in the context of threats to information security. The technological process and its stability at CII facilities in the aspect of information security are studied. The analysis of regulatory legal acts (NPA) and scientific publications on the research topic is carried out. The analysis of the NPA of the CII showed that there are serious problems in this area. In order to formulate specific measures of sustainability of indicators, one can use the given sustainability matrix. The paper formulates the requirements for evaluation indicators. Based on the results of the study, it was found that the assessment of the stability of the functioning of objects can be implemented on real significant objects of the CII, while the stability coefficients of the elements can be detailed in more detail. Definitions and problems are considered, the main sources confirming the importance of the study are presented. The results of the study can be used when considering approaches to assessing the sustainability of technological processes in the context of CII safety.

Типовые офтальмологические информационные системы, являющиеся объектами критической информационной инфраструктуры

Relevance. According to the law « the security of critical information infrastructure of the Russian Federation» 26.07.2017 No. 187-FZ information systems used in ophthalmology can be classified as significant objects of critical information infrastructure if a targeted computer attack can cause serious damage (assessed by five significance indicators). The study considers common objects of critical information infrastructure in the healthcare sector, analyzes typical ophthalmic automated control systems, assesses actual offenders for these systems and the consequences of the implementation of information security threats by them, based on which refined criteria are developed for classifying objects as significant. Purpose. Analysis of typical processes of information systems in the field of ophthalmology. Justification of the choice of systems belonging to the category of «critical». Material and methods. Common objects of critical information infrastructure in automated control systems is carried out. Results. An assessment of actual violators for information systems in the field of ophthalmology was carried out. The consequences of security breaches are identified, based on which refined criteria are developed for classifying objects as significant. Conclusion. The first step in the categorization process is to determine the list of objects (information systems) that are most critical in terms of the consequences of computer attacks for the functioning of a critical infrastructure subject. Not all enterprise information systems provide critical information processes and have signs of a significance category. Keywords: critical information infrastructure, healthcare sector, ophthalmology, information security threats, intruder model, categorization criteria

Актуальные угрозы безопасности информации в сфере здравоохранения и офтальмологии

Relevance. All healthcare institutions, including ophthalmology, belong to critical information infrastructure, which is described in law on «the security of critical information infrastructure of the Russian Federation» 26.07.2017 No. 187-FL. It is mandatory to carry out the compliance of critical information infrastructure objects with the established criteria and indicators of significance for these institutions. The article deals with the issues of information security risk assessment and categorization in relation to organizations working in the field of ophthalmology. The research was carried out as part of the implementation of the federal project «Information Security» of the national program «Digital Economy of the Russian Federation». Purpose. Analysis of the features of the categorization process for ophthalmology organizations, designing decision-making algorithm for assigning a category of significance. Material and methods. The article deals with the issues of information security risk assessment and categorization in relation to ophthalmology organizations. The study was carried out as part of the implementation of the federal project «Information Security» (the national program «Digital Economy of the Russian Federation»). Results. The consequences of the implementation of attacks on information systems that are significant for specific types of critical information infrastructure objects in the healthcare sector (in the field of ophthalmology) were considered. The choice of significance criteria was substantiated. An algorithm for making a decision on assigning a category of significance was developed. Conclusion. An analysis of current threats to critical information infrastructure facilities in the healthcare sector was explored. It was found that in the proposed methodologies, the detection of the possibility of detecting an object under the first detection is not wide enough, which may seem to be based on unreasonable costs to ensure the necessary level of security for healthcare and ophthalmology facilities. Keywords: critical information infrastructure, healthcare institution, ophthalmology, information security threats, intruder model, actual threats, computer incidents

Principles of operation and detection on the target system of the dual purpose tool Cobalt Strike

The article investigates the nature of the functioning of the dual-purpose tool Cobalt Strike, which actively uses APT (Advanced Persistent Threat) in its arsenal primarily to gain unauthorized access to information systems and their information assets. Considering the extent of the widespread use of Cobalt Strike, it is advisable to consider the principle of its operation and possible measures to counter its penetration into the information systems of objects of critical information infrastructure.

Big Data in healthcare: cybersecurity and legal protection of personal data

Digitalization of Russian healthcare leads to an increase of digital medical data, which eventually becomes Big Data and requires secure ways to collect, process, store and use such information. In this article, the authors analyze legal acts that govern ways to protect medical information in digital form, as well as those that establish the legal regime of personal data. The authors draw attention to the risks of re-identification of anonymized medical data and difficulties to comply with some requirements of the personal data legislation in use of Big Data technologies. In discussion on liability for offences and crimes in the sphere of computer information, the authors propose to consider healthcare information systems containing personal data as objects of critical information infrastructure of the Russian Federation. Such regime would allow to charge unlawful access to the information contained and other criminal acts under Article 274¹ of the Criminal Code of the Russian Federation. Prevalence of information and communication technologies as a method of encroachments on the digital medical data, and ultimately an intrusion into privacy, leads authors to the conclusion about expediency of addition of Article 137 of the Criminal Code of the Russian Federation with the relevant aggravating circumstance.

Quantum computing in controlling railroads

The paper discusses the main possibilities of using quantum computing and technologies in railway management, highlighting the most promising options and proposals for their application. One of the main objectives of the RZD "Russian Railways" is the research and implementation of quantum telecommunications as the basis for building promising network services. By focusing on improving solutions in the field of automation of railway transport process management, and taking into account the over-growing and changing needs of customers, RZD also wants to trans-form to digitalization and use quantum computing to create flexible management models, optimization of the structure and decision-making processes and the use of quantum computers both in information systems and in technical control systems. The study first identifies areas where the development of information technologies in railway transport is a must. Then the strategies and programs to digitalis these fields are discussed, how they are implemented is shown and finally a comparison is then made with other experiences from different agencies around the world. The Study concludes that the creation of quantum information systems with a contactless neuro-computer interface will solve several problems like the performance of duties by railway personnel, monitoring of significant objects of critical information and technical infrastructure, and public services. It is advisable to use quantum technologies and calculations in railway transport in the following main directions: the creation of a quantum telecommunication network; the introduction of quantum computing in the improvement of Blockchain technologies; use of quantum technologies to solve complex optimization problems.

Adaptive Control System for Detecting Computer Attacks on Objects of Critical Information Infrastructure

Adaptive Control System for Detecting Computer Attacks on Objects of Critical Information Infrastructure

Threats to information security of state corporations of the Russian Federation

Objectives. Structuring of publicly available information to identify the distinctive features inherent in state corporations of the Russian Federation and to describe the threats arising as a result of their continuous operation.Method. The following methods of scientific cognition are used: systematization, description, analysis, deduction. The characteristics of state corporations are formed on the basis of data obtained both from the regulatory framework and by means of analysis of modern research in the field. In the future, the systematization of knowledge about the threats of state corporations is carried out, the most common classifications are considered, the increasing activity of intruders regarding critical information infrastructure objects is noted, and possible consequences for the state corporation after a successful computer attack on them are noted.Result. In this paper, a study was conducted on a little–covered area in the scientific literature - the protection of Russian state corporations. A comprehensive analysis made it possible to characterize the object of research in detail, thereby specifying the significant aspects of its functioning. Next, the most significant threats of Russian state corporations were shown, the importance of ensuring information security was noted and 15 factor influences of a successful cyberattack were shown.Conclusions. The conducted research is of an overview nature. The materials presented in the paper can serve as a basis for further research in the direction, as well as the formation of principles of protection against the mentioned threats.

УСТОЙЧИВОСТЬ ФУНКЦИОНИРОВАНИЯ ОБЪЕКТОВ КРИТИЧЕСКОЙ ИНФОРМАЦИОННОЙ ИНФРАСТРУКТУРЫ

The purpose of the paper is to consider the sustainability of the functioning of critical information infrastructure (CII) facilities. The states should ensure proper protection of their significant (if any) CII facilities. Significant negative consequences may arise for the subjects of the CII of Russia, critical sectors of the economy that have hundreds or even thousands of CII objects in their composition. As a result, this may lead to disruption of technological processes at a significant CII object. In order to ensure the stable operation of an object classified as a CII, it is required to perform an assessment of its (sustainable) functioning. Evaluation of the effectiveness of the applied measures to ensure the safety of significant objects (ZO) of the CII requires an assessment of the stability of their functioning, which is inherently determined by the stability of their critical processes. However, currently there is no generally accepted approach to conducting such an assessment and its definition is an urgent task. The objects of the research are the CII objects. The subject of the study is the sustainability of the functioning of data (CII) objects in the conditions of threats to information security (IS). The stability of CII objects are examined. The analysis of regulatory legal acts (NPA) and scientific publications on the research topic is carried out. This analysis of the NPA of the CII showed that there are problems in this area, therefore, the approach to ensuring the safety and stability of the functioning of both the CII and its individual objects should be based on certain principles. The main definitions and problems are discussed, the arguments confirming the importance of the study are provided. The results of the study can be used when considering approaches to assessing the functioning of CII facilities and improving the assessment of its stability.

A study of ways and solutions to increase the efficiency of detecting computer attacks on the objects of critical information infrastructure

Introduction: In the era of information technology almost all organizations face a wide range of automated and rapidly spreading cyber threats. This is due not only to the growing complexity, diversity and scale of digitalization, but also to the enlargement of cyber threats and the area of their possible implementation. Purpose: To compare possible ways of improving the effectiveness of attack detection for the objects of critical information infrastructure (CII): to detect a rare event, anomaly or novelty in the functions of the objects of CII. Results: The principle of operation of the proposed (effective) approach to cyberattack detection is to identify and separate anomalies from normal functioning of objects with the use of the concept of dynamic change of labels for a variable class over time. Dynamic novelty detection is compared to other approaches in terms of F1-score. For SWaT data, which is a layout of a critical information infrastructure object as an automated control system, it was determined that attack detection improved by up to 7% using the proposed approach. Practical relevance: The results of the research have shown a reduction in the risk of conducting (developing) a computer attack on critical information infrastructure objects. A possible targeted application of the dynamic novelty detection approach is to optimize the means of protecting information at critical information infrastructure facilities, as well as to integrate the proposed approach into the information security system as an intelligent detector.

Категорирование взаимосвязанных объектов критической информационной инфраструктуры

The problem of building an information infrastructure resistant to computer attacks is relevant for organizing the work of any enterprise. Therefore, the ability to assess the existing or developing information infrastructure is very important. In this regard, the article deals with the problem of categorizing objects of critical information infrastructure in the context of the need to assess their relationship. The current legislative acts, which are the information base for determining the objects of critical information infrastructure and determining their purpose, structure and composition, are considered, as well as the criteria for the significance of objects are determined. The article also defines the links between critical information infrastructure objects, their resistance to computer attacks, as well as possible damage due to disruption of their functioning or the performance of a critical process. The article provides a description of the criteria that are subject to assessment and a methodology for assessing the stability of critical information infrastructure objects to computer attacks and assessing possible damage due to disruption of the functioning or performance of critical processes by objects of critical information infrastructure. An augmented solution is proposed for assessing the stability of the functioning of critical information infrastructure objects with various options for their connection. The possibility of assessing the cumulative damage due to disruption of the functioning of interconnected objects of critical information infrastructure is considered.

Problems of forming the structure of functions of the information security management system of a significant object of critical information infrastructure

In such a tense geopolitical situation, and as a result, the tightening of the legislation of the Russian Federation regarding the requirements for information protection systems for critical information infrastructure objects, it becomes especially important to ensure the security of critical information infrastructure. Every year, the requirements for the information security system of significant objects of critical information infrastructure become more and more serious. The use of heterogeneous information security tools creates a contradiction, which consists in the presence of such information security tools and the impossibility of their centralized management. Such a contradiction can be resolved by developing an information security management system with a formed structure of the functions of such a system. This article presents the concept of solving the problem of forming the structure of the functions of the information security management system of a significant object of critical information infrastructure, the concept of building an information security management system of a significant object of critical information infrastructure, as well as the concept of checking the effectiveness of such a system.