Critical Information Infrastructure Research Articles

Enhancing the factor analysis of information risk methodology for assessing cyberresilience in critical infrastructure information systems

Enhancing the factor analysis of information risk methodology for assessing cyberresilience in critical infrastructure information systems

Problems of the Criminal Law Protection of Critical Information Infrastructure of the Russian Federation

The article discusses the problems of improving criminal law norms regulating liability for unlawful impact on critical information infrastructure of the Russian Federation. The urgency of the research topic is connected with a growing number of such crimes and the recent adoption of Art. 274.1 of the Criminal Code of the Russian Federation. According to statistics, the number of attacks against critical information infrastructure is extremely high, however, a considerably smaller number of incidents are registered as crimes. One of the reasons behind this situation is the inadequacy of Art. 274.1 of the CC of the RF. The author draws attention to the fact that Part 1 of Art. 274.1 of the CC of the RF does not meet the criteria for criminalization, and its legal construction hinders the effective work of investigation and court bodies’ employees. As a result, this widespread publicly dangerous act is not duly reflected in judicial and investigation practice. At the same time, the current Art. 273 of the CC of the RF has considerable potential for including unlawful creation, dissemination and (or) use of any computer software in relation to critical information infrastructure or information contained in it. The author notes that the concept used in the current edition of Art. 274.1 of the CC of the RF «harm to the critical information infrastructure of the Russian Federation» is non-specific, and leads to delays, mistakes and confusion in legal practice. The article proves that Parts 2 and 3 of Art. 274.1 of the CC of the RF could ensure better liaison with other legal acts if their dispositions included the categories «computer attack» and «computer incident». The introduction of the above-mentioned attributes could also contribute to the consistency of court practice and the elimination of ambiguous interpretations. The analysis of the subjective side of crimes under Art. 274.1 of the CC of the RF allowed the author to conclude that mercenary motivation and the goal of concealing or aiding another crime should be viewed as qualifying features. To prove this position, the author points out that these features are wide-spread and used for the construction of corpus delicti of other crimes, and also cites the opinions of legal scholars.

A certificateless Multi-receiver Encryption scheme based on SM2 signature algorithm

The Multi-receiver Encryption (MRE) scheme can meet the secure data transmission requirements in multicast and broadcast scenarios. To meet compliance, critical information infrastructure in China should be protected with Chinese national commercial cryptographic algorithms. Designing an MRE scheme based on Elliptic Curve Cryptography (ECC) is one of the current design methods with better flexibility and performance. However, the research on MRE schemes based on SM2 elliptic curve public-key cryptography is still in a blank state. This paper proposes a Certificateless SM2-based Multi-receiver Encryption (CL-SM2-MRE) scheme. We prove the security of the CL-SM2-MRE scheme under the Random Oracle Model (ROM) and analyze the performance.

Information about computer handwriting: The challenges of finding a balance between individual liberty and state security

The present study is devoted to the introduction of biometric identification systems in law enforcement. The author pays special attention to the phenomenon of computer handwriting, examining in detail the constitutional and legal aspects of the use of knowledge about it. For this purpose a wide methodological apparatus is used: comparative-legal method, method of analogy, deduction, method of modelling and others. The Russian practice and potential for further development are compared with the experience of foreign countries both in the regulation of general issues of biometric personal data and in situations of legal regulation of computer handwriting data. The author investigates how to simultaneously solve the problems of detection and investigation of offences in which printed texts act as evidentiary materials, and at the same time preserve human rights to privacy, personal and family secrecy, anonymity on the Internet. It is noted that computer handwriting is a rather young phenomenon for legal science; there is still no in-depth study of it from the perspective of this field of knowledge. This paper is only a beginning in understanding the topic under consideration. It raises basic questions: whether it is permissible to use knowledge about computer handwriting, how it should be protected and where it should be stored, whether it is necessary to limit the existing commercial interest in its use. As a result, the author comes to the following conclusions: it is permissible and necessary to collect information on computer handwriting, as this will reduce infringements on the natural rights of man and citizen. For such collection it is necessary to use a centralised state system in which all the requirements for the security of critical information infrastructure are implemented. However, before such a system is put into operation, it is necessary to support commercial companies in relevant developments and oblige them to provide information about users' computer handwriting at the request of authorised persons.

Ensuring information security in order to preserve the national interests of Russia at the beginning of the 21st century

The purpose of this article is to analyze the main risks of information security in Russia in the new millennium and the effectiveness of information security programs in the Russian Federation. The object of the study is the information security system of the Russian Federation. The article identified the main risks of information security in Russia, such as cybercrime, violations of the rules for processing personal data, leaks of confidential information, and others. The authors analyzed the distribution of the listed types of threats to information security of Rostelecom's client companies for 2022. Attention is focused on the fact that a low culture of information security among military personnel and personnel working at the facilities of the Armed Forces can lead to vulnerabilities and risks of data leakage of important strategic facilities. The programs for ensuring information security of the Russian Federation were considered, including the Federal Target Program "Information Russia", the Federal Law "On the Protection of Personal Data" and others. The authors identified the main goals and indicators of such national programs. An analysis of the effectiveness of the information security system of the Russian Federation is carried out and a forecast of its development is presented. State programs aimed at developing the digital economy, protecting critical information infrastructure, developing mechanisms to combat cyber threats, as well as creating modern technologies for the Russian Armed Forces and cryptography are the key areas of Russia's work in this area. The authors also analyzed the forecast for the development of the Russian cybersecurity market, as well as the global forecast for the development of information security technologies. It is concluded that despite the measures taken by the Russian Federation to ensure information security, the system is still vulnerable to new threats. recommendations were developed to improve the current information security system in the Russian Federation.

Актуальные угрозы безопасности информации в сфере здравоохранения и офтальмологии

Relevance. All healthcare institutions, including ophthalmology, belong to critical information infrastructure, which is described in law on «the security of critical information infrastructure of the Russian Federation» 26.07.2017 No. 187-FL. It is mandatory to carry out the compliance of critical information infrastructure objects with the established criteria and indicators of significance for these institutions. The article deals with the issues of information security risk assessment and categorization in relation to organizations working in the field of ophthalmology. The research was carried out as part of the implementation of the federal project «Information Security» of the national program «Digital Economy of the Russian Federation». Purpose. Analysis of the features of the categorization process for ophthalmology organizations, designing decision-making algorithm for assigning a category of significance. Material and methods. The article deals with the issues of information security risk assessment and categorization in relation to ophthalmology organizations. The study was carried out as part of the implementation of the federal project «Information Security» (the national program «Digital Economy of the Russian Federation»). Results. The consequences of the implementation of attacks on information systems that are significant for specific types of critical information infrastructure objects in the healthcare sector (in the field of ophthalmology) were considered. The choice of significance criteria was substantiated. An algorithm for making a decision on assigning a category of significance was developed. Conclusion. An analysis of current threats to critical information infrastructure facilities in the healthcare sector was explored. It was found that in the proposed methodologies, the detection of the possibility of detecting an object under the first detection is not wide enough, which may seem to be based on unreasonable costs to ensure the necessary level of security for healthcare and ophthalmology facilities. Keywords: critical information infrastructure, healthcare institution, ophthalmology, information security threats, intruder model, actual threats, computer incidents

Исследование критической уязвимости сервиса аутентификации и последствий для медицинских учреждений, относящихся к субъектам критической информационной инфраструктуры

Relevance. The functionality of malware has grown exponentially in recent years. There are more and more ways in which attackers can gain access to secret or personal data, as well as information stored in critical information infrastructure, including those related to the healthcare sector, but the consequences of attacks on such objects lead to serious consequences. A striking example is the leak of data to the public from the database of the unified dispatch service of the Lipetsk Region, which contained a lot of information about the patient, including their full name and address. Purpose. Investigation of the vulnerability BDU:2022-05212, which allows an attacker to gain full rights to the infrastructure. On the basis of the research done, to study the principles of operation of this vulnerability, as well as classify it and identify the consequences for CII objects. Make a list of measures necessary to ensure security against attacks of this kind. Material and methods. This article describes how to gain unauthorized access through the CAS administrative interface by calling the URL on the page that is used to install the default on the server and create the first administrator user. As well as an experimental study of this vulnerability, methods for its detection and consequences for CII subjects was carried out. Results. In accordance with the Federal Law of July 26, 2017 Nо. 187-FZ, definitions are considered that allow classifying information systems in the field of health care as CII and consider an actual example of data leakage in this area due to the vulnerability of the CAS server at the network level. The article also discusses the basics of the CAS server, compiled a vulnerability classification table BDU:2022-05212, and indicated the basic vulnerability vector metric according to the FSTEC standards. The conclusion in this article is based on how to protect against this vulnerability, as well as recommendations for resolving the problem if the attack has already been committed before. The results of the study will improve the level of authentication security in web applications and sites using CAS server technologies, organizations operating in the banking sector, as well as in the healthcare sector related to CII. Conclusion. The article puts the key – the security of the infrastructure of subjects of critical information infrastructure in the field of healthcare. This article will be useful for employees of the information security department working with CII objects, especially those operating in healthcare, banking, and other areas of the financial market. Keywords:critical information infrastructure protection, information security, healthcare industry, vulnerabilities, infotelecommunications

Типовые офтальмологические информационные системы, являющиеся объектами критической информационной инфраструктуры

Relevance. According to the law « the security of critical information infrastructure of the Russian Federation» 26.07.2017 No. 187-FZ information systems used in ophthalmology can be classified as significant objects of critical information infrastructure if a targeted computer attack can cause serious damage (assessed by five significance indicators). The study considers common objects of critical information infrastructure in the healthcare sector, analyzes typical ophthalmic automated control systems, assesses actual offenders for these systems and the consequences of the implementation of information security threats by them, based on which refined criteria are developed for classifying objects as significant. Purpose. Analysis of typical processes of information systems in the field of ophthalmology. Justification of the choice of systems belonging to the category of «critical». Material and methods. Common objects of critical information infrastructure in automated control systems is carried out. Results. An assessment of actual violators for information systems in the field of ophthalmology was carried out. The consequences of security breaches are identified, based on which refined criteria are developed for classifying objects as significant. Conclusion. The first step in the categorization process is to determine the list of objects (information systems) that are most critical in terms of the consequences of computer attacks for the functioning of a critical infrastructure subject. Not all enterprise information systems provide critical information processes and have signs of a significance category. Keywords: critical information infrastructure, healthcare sector, ophthalmology, information security threats, intruder model, categorization criteria

Нормативно-правовые проблемы безопасности территориально распределенных информационных систем в офтальмологии

Purpose. To consider, characterize and analyze the regulatory framework of the Russian Federation, which determines the use of information technologies in ophthalmology, without which it is now impossible to provide high-tech medical care. Material and methods. The subject of this study is the legislation of the Russian Federation devoted both directly to the health care system in our country and to the requirements for ensuring information security. In accordance with the specifics of the subject under study, general scientific research methods were necessarily used in this work: analysis and synthesis, deduction and induction. Results. The legal system of the Russian Federation is not so specialized in the use of information technologies in medicine that in ophthalmology there would be some special regulatory framework, different from other types of medical activities. The objective basis of this universality is that it is practically the same technological base everywhere in medicine. Conclusion. The presence of all the necessary conditions determining belonging to the status of a subject of critical information infrastructure creates sufficient grounds for the applying of requirements related to the regulation of medical activities based on the Federal law «On the Security of Critical Information Infrastructure of the Russian Federation». Keywords: medicine, information technology, information security, critical information structure of the Russian Federation

Modelling language for cyber security incident handling for critical infrastructures

Cyber security incident handling is a consistent methodology with which to ensure overall business continuity. However, specifically handling incidents for critical information infrastructures is challenging owing to the inherent complexity and evolving nature of the threat. Despite the number of contributions made to cyber incident handling, there is little evidence of literature that focuses on modelling activities that will enhance developers’ abilities to model incident handling processes and activities according to different views. Modelling languages of this nature should integrate essential concepts and a descriptive implementation process in order to enable developers to analyse, represent and reason about the crucial incident handling efforts required to support critical information infrastructures. The aim of this paper is, as part of the CyberSANE EU project, to develop a Cyber Incident Handling Modelling Language (CIHML) that focuses explicitly on modelling incident handling in the context of a critical information infrastructure. The work is innovative in its approach because it consolidates concepts from various domains such as security requirements, forensics, threat intelligence, critical infrastructures and cyber incident handling. The approach will allow the phases of the incident handling lifecycle to be modelled from three different views (critical information infrastructures, threat and risk analysis, and incident response). An implementation process is also proposed, which will serve as a comprehensive guide for developers in order to create these modelling views. Finally, CIHML is evaluated using a real-life scenario from the CyberSANE project to demonstrate its applicability. The incident observed had a severe impact on the overall business continuity of the context studied. The results obtained from the study show that CIHML can help critical information infrastructure operators to identify, evaluate, represent and model cyber incidents in critical information systems, in addition to providing the support required to determine the response strategies needed in order to mitigate these cyber-attacks.

ФУНКЦИОНАЛЬНОСТЬ СЕТИ КИБЕРБЕЗОПАСНОСТИ КРИТИЧЕСКОЙ ИНФОРМАЦИОННОЙ ИНФРАСТРУКТУРЫ

The analysis of modern approaches to countering computer attacks on critical information infrastructure (CII), presented in the form of distributed information resources, shows that there is an objective need for technological development of this direction. In this aspect, the most promising solution to this problem seems to be the use of the concept of "Cybersecurity Mesh" (cybersecurity networks), introduced by Gartner without precise instructions on practical implementation and possible technological solutions. This paper presents the results of a study of functional requirements for systems implemented in accordance with the above concept, on the basis of which a new architecture of CII cybersecurity will be set in the future. The features of its application proposed by the authors of the concept are considered in detail, on the basis of which the requirements for the functional structure of possible technological requirements have been developed. It consists of four basic levels that allow you to respond flexibly to emerging integration and security challenges. These levels include: intelligent information security and analytics, distributed identity structure, consolidated policy and state management, consolidated interactive dashboard. To meet the specified functional requirements, a technological model for building a cybersecurity network is proposed in the form of an organic combination of three fairly heterogeneous technologies: 5G mobile communications, Secure Access Edge (SASE - Secure Access Service Edge) and advanced detection and response (XDR) into a consolidated cloud platform. The results of the studies of the functionality of the concept of a cybersecurity network can be considered as a methodology for ensuring the security of CII, implying a transition from building a single secure digital perimeter around all its devices or nodes to point protection of each remote access point. This publication can be useful for experts in the security forces of CII facilities, as well as to employees of educational institutions in the implementation of appropriate training, retraining and advanced training programs for such specialists.

Подсистема предупреждения компьютерных атак на объекты критической информационной инфраструктуры: анализ функционирования и реализации

The purpose of the article: conducting a system analysis of the requirements for the subsystem for preventing computer attacks on critical information infrastructure in order to substantiate the directions for further improved scientific and methodological apparatus for the full functioning of the subsystem for preventing computer attacks. Research method: theoretical and systematic analysis of the requirements of legal acts, scientific publications, protection technologies and means of their implementation in departmental systems for detecting and counteringcomputer attacks.The result obtained: the rationale for the need to build mechanisms for preventing computer attacks on critical information infrastructure objects and the requirements for the subsystem for preventing computer attacks was carried out, an approach was proposed to prevent computer attacks at the stages of reconnaissance by an attacker of critical information infrastructure objects, based on the introduction of a security event correlation mechanism with automatic adaptation to the analyzed information infrastructure and the functions it performs at the current time and a detailed specification of the correlation rules.Scope of the proposed approach: a subsystem for preventing computer attacks of departmental systems for detecting and countering computer attacks, which should identify and prevent attempts to conduct computer attacks on critical information infrastructure objects in advance.The scientific novelty consists in a comprehensive analysis of the need to build mechanisms for preventing computer attacks on critical information infrastructure objects, an analysis of the requirements for the computer attack prevention subsystem, its functions and means of implementation. It is shown that the functions of preventing computer attacks in domestic technical solutions are not fully implemented, and that there is a substitution of the concept of “subsystem for preventing computer attacks” by the concept of “control and technical measures”. It is substantiated that for the implementation of the functions of preventing computer attacks, there is a technological backlog in the form of a ready-made technology based on the technology for building SIEM systems. It is shown that there is a need to refine the scientific and methodological apparatus for implementing computer warning functions based on artificial intelligence methods and big data technologies.Contribution: Kotenko I.V. - analysis of the functionality of the subsystem for preventing computer attacks, setting the task and proposals for developing the functionality of the subsystem for preventing computer attacks on critical information infrastructure objects; Saenko I.B. - analysis of the subsystem for preventing computer attacks in the general context of the theory of information security, substantiation of the implementation of the functions of preventing computer attacks based on the technology of building SIEM systems and big data; Zakharchenko R.I. - analysis of technical solutions that ensure the implementation of the subsystem for preventing computer attacks, Velichko D.V. - an approach to detecting computer attacks at the stages of reconnaissance by an attacker of objects of critical information infrastructure. All authors participated in the writing of the article.

Criminal liability for unlawful impact on critical information infrastructure under the laws of South Korea, Bangladesh and the Philippines

Criminal liability for unlawful impact on critical information infrastructure under the laws of South Korea, Bangladesh and the Philippines

Quantum computing in controlling railroads

The paper discusses the main possibilities of using quantum computing and technologies in railway management, highlighting the most promising options and proposals for their application. One of the main objectives of the RZD "Russian Railways" is the research and implementation of quantum telecommunications as the basis for building promising network services. By focusing on improving solutions in the field of automation of railway transport process management, and taking into account the over-growing and changing needs of customers, RZD also wants to trans-form to digitalization and use quantum computing to create flexible management models, optimization of the structure and decision-making processes and the use of quantum computers both in information systems and in technical control systems. The study first identifies areas where the development of information technologies in railway transport is a must. Then the strategies and programs to digitalis these fields are discussed, how they are implemented is shown and finally a comparison is then made with other experiences from different agencies around the world. The Study concludes that the creation of quantum information systems with a contactless neuro-computer interface will solve several problems like the performance of duties by railway personnel, monitoring of significant objects of critical information and technical infrastructure, and public services. It is advisable to use quantum technologies and calculations in railway transport in the following main directions: the creation of a quantum telecommunication network; the introduction of quantum computing in the improvement of Blockchain technologies; use of quantum technologies to solve complex optimization problems.

Radar stations as a means of ensuring the security of critical information infrastructure

Radar stations as a means of ensuring the security of critical information infrastructure

ІНФОРМАЦІЙНА ЕКОНОМІКА: МОЖЛИВОСТІ ТА ЗАГРОЗИ В РЕАЛІЗАЦІЇ НАЦІОНАЛЬНИХ ІНТЕРЕСІВ

The article examines opportunities and threats in the realization of national interests in the conditions of the development of the information economy. Expert assessments of global technological risks, were considered, including: adverse consequences of technological progress for individuals, enterprises, ecosystems; digital inequality; digital concentration of power; ineffectiveness of cyber security measures; non-compliance with management technology; destruction of critical information infrastructure. It is noted that the given global risks form systemic needs that determine the main trends of change in modern society. It has been proven that the rapid transformations caused by informatization will change economic systems, new tools for coordinating economic interests will appear, which will lose the role of restraining counterbalances, which provokes imbalances and contradictions at all levels of socio-economic relations. A number of factors are outlined, which in their aggregate manifestation affect the balance of agreed economic interests at any level of the system of socio-economic relations. Among such factors, the following are defined: the uncertainty of the limits of intervention in the spheres of interests of the state, business and society; lack of timely methodical support of informatization processes; different vision of information economy development in each country; a change in the role of a person as a subject of economic activity as a result of the virtualization of the economic environment; the participation of the state in the processes of coordination of economic interests is based on the "right of the strong" and encourages each country to use economic institutions and tools to promote its own interests, provoking conflicts and new challenges on the world stage. It has been proven that new realities require a review of the limits of the protection of national economic interests in the conditions of the formation of new rules of the game and norms of the information economy in order to ensure the security component of the country's development. It is noted that such actions should be carried out within the framework of the formation of the regulatory environment of the information economy, which is a complex process that requires balancing the economic interests of key subjects in the paradigm of "state-population-business" relations and their subordination to national interests.

Множество вариантов решений для задачи выбора мер защиты объектов критической информационной инфраструктуры

Cybersecurity of critical information infrastructure is achieved by developing an information security system. It includes organizational and technical measures. The complexity in its development is not only the choice of information security measures (it depends on many criteria), but also the compilation of a set of all options suitable for solving this problem, especially if the object of critical information infrastructure is a state (municipal) information system or a personal data information system. In this paper, a comparative analysis of all possible protection measures is carried out to obtain a consolidated set of options.

Правовые проблемы обеспечения информационной (кибер-) безопасности энергетического сектора в условиях цифровизации

The purpose of this paper is the study of problems of the legal support of information (cyber) security in the energy sector to enable making an attempt at the identification of key areas of further development of the legal regulation, inter alia, on the legislative level. Modernization of such legal institution as information security is a necessity and a priority especially considering the geopolitical conditions. Due maintenance and protection of information security facilities is the basis for the state, economic and social stability. The article concludes that there is a need to develop a system of proper certification of software products used in the fuel and energy complex, create public-private intermediary institutions to regulate issues of information security in the fuel and energy complex, pays attention to the classification of critical information infrastructure facilities and the development of an up-to-date regulatory framework in the sphere of regulation of information security of energy facilities.

МЕХАНИЗМЫ ЗАШИТЫ МОДЕЛЕЙ МАШИННОГО ОБУЧЕНИЯ ОТ СОСТЯЗАТЕЛЬНЫХ АТАК

The problems of protection for intelligent information systems are acutely relevant due to their application in the subjects of critical information infrastructure. The most difficult to identify are adversarial attacks on machine learning models, which are carried out during transfer and federative training of already pre-trained models. At the same time, the anatomy of adversarial attacks is rarely covered in the Russian-language segment of publications, and the defenses against them and mechanisms for evaluating protection against attacks on machine learning models are practically absent, which actualizes the need for the analytical review presented in the article. Purpose: the purpose of the study is to conduct an analytical review and a formalized description of the defenses for machine learning models that are the target of adversarial attacks. Results: based on the classification of attacks aimed at machine learning models, the modern principles of their defenses are formalized. Unlike existing publications, our review highlights and summarizes not only the types of attacks on machine learning models, but also the mechanisms of their implementation. The classification of existing methods of protection against adversarial attacks is carried out. Practical relevance: as a result of generalization, the necessary requirements for the construction of models protected from adversarial attacks are formulated. Discussion: The main attention when building protection mechanisms for machine learning models and evaluating their reliability should be focused on countering complex adaptive attacks that clearly identify and target the weakest links of protection.

Principles of operation and detection on the target system of the dual purpose tool Cobalt Strike

The article investigates the nature of the functioning of the dual-purpose tool Cobalt Strike, which actively uses APT (Advanced Persistent Threat) in its arsenal primarily to gain unauthorized access to information systems and their information assets. Considering the extent of the widespread use of Cobalt Strike, it is advisable to consider the principle of its operation and possible measures to counter its penetration into the information systems of objects of critical information infrastructure.