Security Management Process Research Articles

Detection of malicious requests aimed at disrupting the availability of cyber-physical systems

The work is devoted to solving the problem of algorithmization of the security management processes of cyber-physical systems by detecting malicious requests aimed at disrupting the availability of management interfaces. Particular attention is paid to attacks aimed at denial of service of cyber-physical systems by sending HTTP-flood to web management interfaces. This paper proposes algorithmic provision for comprehensive adaptive analysis of incoming requests. The proposed algorithm for the detection of malicious requests analyses the activity of the investigated components of the cyber-physical system's web service at various network levels. The work applies a visual analysis and data processing method based on the representation as a single normalized set. The raw data of the analysed queries is grouped in a special way to detect a particular anomaly as a suspected threat. Examples of data changes and security responses are given. The experimental results confirm that the proposed algorithmic software achieves first- and second-order error reduction compared to the commonly used regression models in modern application-layer firewalls. The results obtained can be applied to the further development of the theory of information security, in particular the information security of cyber-physical systems and systems of processing of especially protected confidential information.

PROTECTION OF INFORMATION RESOURCES OF SMALL ENTERPRISES, INCLUDING THE SUBSYSTEM FOR MANAGEMENT OF NON-TECHNICAL ASPECTS OF INFORMATION SECURITY

Information is one of the key resources of a modern economic organization. Companies with access to up-to-date, unique, useful and reliable information can compete effectively with other economic entities in today’s turbulent economic environment. Information management takes place in the space of the information system. An increasing part of this system now constitutes the information system which has largely become the primary storage and processing environment for information resources.Information, regardless of the size of the enterprise, is exposed to similar threats and risks of loss or destruction. However, the size of an enterprise, through its material resources, its capabilities in hiring qualified staff, very often determines the range of possibilities to counter potential threats and minimize the potential risk of loss of intangible resources. In this paper, the author attempts to classify, identify the risk areas for small entities which generally have the least potential to implement effective, modern information security management processes. The empirical part presents the original design of a subsystem of the Information Security Management System supporting the processes of mitigating the risk of threats to intangible resources of small enterprises.

Comprehensive cyber security for port and harbor ecosystems

Global maritime transportation and logistics systems are essential parts of critical infrastructures in every society, and a crucial part of maritime logistics processes are seaports. In the coming years, digitalization and increased levels of autonomy in logistic transport chains are expected to take leaps forward. This development can help create safer, more efficient, more sustainable, and more reliable service chains to meet the requirements for a better quality of life and global prosperity. Port and harbor operations connect the maritime transport to other modes of transportation and enable multimodal transportation. Smart ports play a central role in future transport logistics and supply chains. Digitalization helps improve the efficiency of terminal systems in the processes of these ports. In the best cases, digitalization can also promote the reduction of emissions by optimizing port operations and enhancing cargo and people flows while improving the experience for all stakeholders. The improvement of port processes relies on the development of information and communication technology (ICT) as well as on industrial control systems (ICS) and operation technologies (OT). At the same time, the cyber security of maritime logistics also needs to be addressed. This article presents our findings related to the Sea4Value research goal on cyber security, which is a comprehensive cyber security architecture for port services at the system level. The article emphasizes the importance of a system of systems approach in terms of a comprehensive cyber security management process for port ecosystems. The description and recognition of management steps of every stakeholder are the key elements in this kind of process.

METHODOLOGICAL APPROACHES TO ASSESSING THE LEVEL OF MANAGEMENT OF ECONOMIC SECURITY OF ENTERPRISES

The article presents the results of research on the generalization and formation of the main provisions of methodological approaches to the assessment of the level of management of the economic security of enterprises in accordance with modern globalization changes. Criteria for assessing economic security have been determined. It is noted that the development of the system of criteria and parameters characterizing the degree of protection of the enterprise from negative influences is based on a number of proposed principles. The comparative characteristics of the methods of quantitative assessment of the level of threats based on the conditions of application, assessment, accuracy of assessment, costs, accounting for the impact of individual threat factors have been carried out. It is justified to use an approach that reflects the principles and conditions of program-target management and development, which is based on the integration of a set of indicators that determine economic security, to assess the economic security of the enterprise. It was concluded that in an effort to assess the state of such a complex technical and economic system, which is a modern enterprise, which functions in the conditions of the interaction of many internal and external factors, which often have an unpredictable effect on the process of development, production and sale of products, only based on formalized calculations can lead to results that are completely inconsistent with the real state of the enterprise and its development prospects. The proposed model of the interaction of components for assessing the level of management of economic security of enterprises, as a basis for making appropriate management decisions. as well as assessments of the company’s priorities based on the analysis of the state of the level of economic security of the company. In order to adapt the process of economic security management to changing conditions, it is necessary to carry out an effective analysis of solving tasks aimed at improving the functioning of the enterprise.

Scenario planning in national security management: methodological foundations

The article deals with the study of methodological problems of increasing the efficiency of planning and management of ensuring the national security of the Russian Federation in context of uncertainty and risk. The results of the analysis of the main features of national security as a subject area and a complex object of public administration management are presented. The main features of management processes to ensure Russia's national security within the framework of closely interconnected external and internal contours of the subject area under consideration are highlighted. The analysis of the problems and tasks of planning as the central function of the national security management process, which determines the ways to achieve the goals set in the conditions of continuous changes in the external and internal environments, as well as the threats and challenges associated with them, is carried out. To improve the efficiency of managing processes to ensure national security, it is proposed to use a scenario approach, which provides the possibility to develop a complex of planning and management decisions taking into account the alternatives for the future events at the management object and in the external environment under uncertainty and risk. The basic strategies for using scenarios in the processes of long-term and medium-term planning are highlighted and the results of evaluating the effectiveness of various approaches to converting scenarios into concrete plans are presented. The results of the analysis showed that the use of the developed automation technology for scenario-forecast research based on the signed oriented graphs mathematical model as a means of information support for the decision-making processes significantly expands the possibilities of using the scenarios as the planning processes basis in order to increase the validity, efficiency, effectiveness and sustainability of the developed plans and programs.

The Digital Twin Modeling Method of the National Sliding Center for Intelligent Security

There are some problems in the security management of large stadiums, such as complex situations and a lack of coordination among systems. An intelligent security system can effectively improve the efficiency of security management. The digital twin concept is applied to intelligent security systems in large stadiums, and an intelligent security modeling method for large stadiums based on digital twin is proposed. The modeling method of the physical model is presented for the security equipment and building entities. The virtual model is based on geometric, physical, behavioral, and rule models. Considering the particularity of building security, the environmental model is added to describe the environmental information. The application mode of the digital twin model is proposed. In the security management process, multi-source data and virtual models are integrated to analyze and control the security management process of buildings, forming a closed loop of “perception-analysis-control” in security management. Taking the National Sliding Center as an example, this paper verifies the digital twin model and its operation mode of intelligent building security through several possible situations in the operation process of the stadium. The analysis of security data and evacuation path guidance in emergencies are simulated. The digital twin model for intelligent security integrated the building security data and simulation models to assist in identifying the types of dangers and the treatment of emergencies. Furthermore, the control of building equipment was integrated into the security system. The digital twin model for intelligent security improved the integration and intelligence of the security system.

Actual and future digital threats and their impact on civil and military cybersecurity management

Objectives(1) What is the hacker community made up of and what are the main vulnerable industries? (2) What are the main types of digital threats and how are they characterized? (3) What are the vulnerabilities and damage caused by cyber-attacks? (4) What are the ways to detect digital threats? (5) What measures can be taken to prevent and avoid these attacks? (6) What does the cyber security management process consist of? (7) What cybersecurity evidence and trends can be selected?Methodsdocument analysis; data selection and assambly; synthesis; conceptualization; interpretation.ResultsThe research results are: a presentation of the hacker community and the main vulnerable industries; a brief definition of the types of digital threats; presentation of various vulnerabilities and damages caused by cyber-attacks; a selection of the ways to detect digital threats; a selection of the main measures to prevent and avoid these attacks; cybersecurity management process and a selection of evidence and trends regarding cyber security. Also, two conceptualizations are proposed: the approach to cyber risk management and 10 basic actions to prevent and avoid cyber risks.ConclusionsThe current and future situation is not encouraging for the management of organizations in terms of the risks caused by cyber-attacks, which are increasing significantly. The solution to prevent and avoid these threats is for civil and military organizations to implement Cybersecurity risk management.

Information Security : The Landscape of Management In Electronic Record

Protecting information based on physical boundaries and firewall technologies are outdated and inadequate in this area. Today the more efforts to establish a successful information security practice by developing rules regulating and making the users understand how to follow the prescribed information security rules and policies also is not likely to be successful. Thus, a better understanding on holistic process of information security protection in healthcare industry is very important to manage information security management. Nowadays, the increasing role of information technology platform in organizing health information has led to the need of review on the confidentiality, privacy, and security of electronic information. The widespread use of electronic health records (EHRs) in healthcare industry is prevailing. Once information is electronically stored and shared, it opens the door for hackers and other malicious attackers to access the records.. Therefore, this paper is to scrutinize the landscape of security management elements that contribute on successful of implementing security management in healthcare industry. This paper also includes overview on identifying the simple process of security management that will helps any organization in healthcare industry to formulate, implement and manage any medical or hospital information system.

УПРАВЛІННЯ ЕНЕРГЕТИЧНОЮ БЕЗПЕКОЮ ЕКОНОМІЧНОГО СЕРЕДОВИЩА: ПАРАДИГМАЛЬНІ ХАРАКТЕРИСТИКИ

Ensuring the national security of the state is inextricably linked with energy security. The purpose of the article is to study the energy security management process as a human-centered philosophy based on the achievements of scientific and technical development. A study of the market of energy resources was conducted and it was emphasized that the dependence on the import of oil, gas and nuclear fuel negatively affects the state of energy security of the country and creates tension in the economy, social and political spheres. It was added that in view of the threat to energy security and taking into account russia's price policy for energy carriers, European countries have almost completely abandoned/(plan to abandon) natural gas. It is emphasized that the creation of conditions to ensure energy security and energy development is among the state's priorities, as the size, dynamics and performance indicators of the sphere of production and consumption depend on the development of the energy sector. It is shown that Ukraine is one of the least energy efficient countries among the member states of the Energy Community. It has been proven that a change in the energy development paradigm is impossible without solving complex scientific and technical tasks and opening the flow of information, technologies and capital. Management of energy security should be based on people-centered approaches and existing recommendations of the scientific community when adapting them to existing conditions, taking into account the priorities of cyclical economy. At the same time, it is necessary to consider possible crises in the process of economic growth caused by the factors listed in this article. The modernization of the energy sector of the Ukrainian economy will take place based on the effective paradigm of energy security, especially in the post-war period.

Tourism Application Information System Security Audit Using Cobit 5 Framework on Palembang City

Information technology is important in organizations so that the goals and expectations of the objectives of implementing IT can be achieved. The tourism office of the city of Palembang is an institution that has used information technology to help the continuity of their work. The tourism office of the city of Palembang has not conducted an audit of improving the security of the existing information system. Therefore, to avoid events that do not require an information security system audit. Cobit 5 framework that can be used as a reference for information system governance to achieve the expected goals. This study only discusses the security management process which includes the DSS05 (Delivery, service, and security) domain by collecting data using a questionnaire. The value of the level of security improvement to be achieved in the security system should reach level 5 and can provide recommendations that will be followed up by the institution to make improvements in the future.

FINANCIAL SECURITY MANAGEMENT IN ECONOMIC SECURITY SYSTEMS AT DIFFERENT LEVELS OF MANAGEMENT SYSTEMS: METHODOLOGICAL PROBLEMS

Abstract. The main methodological problems of the organization and implementation of the process of financial security management within the functioning of economic systems of different levels are identified. To meet the methodological needs of financial security management under financial security itself, it is proposed to understand the state of protection of financial interests in various sectors and functional areas of financial activities of the economic system and its main participants from external and internal threats, which ensures the effectiveness of economic relations, related to the implementation of financial guidelines for the development of economic, socio-economic, economic systems. It is established that the classical approach to the structure of the financial security subsystem in the system of economic security at any level of management positions it as a set of factors, the state of which determines the financial capacity of the entity or system to counteract economic risks and threats and their negative financial impact on the system respectively. The elements of financial security at the micro and macro levels are systematized according to such parameters as the financial security system, security entities, information principles, personnel component, management mechanism, resources, tools, instruments. A 16-component model of financial security management is proposed, which provides for the possibility of building a management system on four fundamental parameters: organizational culture, progressive and sustainable development, continuous optimization of the management process and ensuring its systemic nature. The proposed formulas for calculating the level of financial security of the state and the level of financial security of the entity based on the author’s approach to segmenting their system for diagnostic purposes allow to obtain a rapid assessment of the financial security of the economic system, of course. Conceptual bases of the system approach to management of financial security of economic system taking into account object of management, subjects of management, the management mechanism, system of maintenance of process of management, principles of management and an estimation of level of safety are presented. Keywords: financial security, financial security management, risk, threat, economic security, economic system. JEL Classification G21, F29, L41. Formulas: 3; fig.: 3; tabl.: 3; bibl.: 10.

Security Planning Identification Model in E-Business

E-Business as an entity that is able to generate profits for organizations / companies and individuals is a valuable asset that must be maintained and protected. In the process of maintaining this, it is not easy because there are many obstacles and problems that must be faced. Various problems that threaten the security of e-Business need to be identified so that in the future the system can ward off these threats. The identification process as the first layer or the initial stage of the stages of security management in e-Business, is very important to do because the next stage is the risk evaluation process, the results depend on the findings that have been identified from this stage. The approach taken in designing a security planning identification model is through a literature study related to the e-Business security management process. The expected results from the formulation are in the form of recommendations for what processes need to be carried out in identifying security plans in e-Business..

Development of cyber-physical system security management process model

Cyber-physical systems (CPS) combine general-purpose information and telecommunication systems and industrial networks and devices (controllers), forming a heterogeneous hierarchical distributed information technology computing environment designed for control and monitoring of technological processes. FSCs are being actively implemented in the industrial, urban and household spheres, allowing for more efficient use of resources, as well as transferring management and feedback processes to a new level. CPS are formed as a result of the aggregation of several heterogeneous information and telecommunication systems, which makes them susceptible to the destructive factors of the digital environment – cyber attacks. The peculiarities of the construction and functioning of the CPS require a new approach to defining attack surfaces and modelling threats. This is due to the fact that the "traditional" goals of attackers - the availability, integrity and confidentiality of information processed in the system - are not the only ones. In addition, the value of the information itself can be extremely low. At the same time, control and feedback processes play a decisive role in a cyber-physical system. Their stability directly affects the ability of the FSC to perform target functions, as well as the physical safety of technological facilities, personnel and consumers. Depending on the degree of criticality of the technological processes of the real world, which are controlled by the cyber-physical system, the violation of these flows inside it can lead to serious consequences, such as large material damage or a threat to the life and health of people. The severity of the identified threats is confirmed by the constantly growing number of attacks on CPS and the consequences, including potential ones, to which these attacks lead. In addition, it should be noted that in the context of the rapid development and improvement of programmable control devices (Programmable Logic Controller (PLC)), making them more accessible in the mass market segment, as well as the proliferation of high-speed wireless data transmission networks, the concept of a smart home is gaining wider application. This approach implies the integration of PLCs that interact with each other and the control centre via multi-service broadband wireless networks into the domestic environment. Thus, the concept of a smart home is based on the implementation of FSCs in places of permanent residence of people with the transfer of automatic control functions of climatic equipment, lighting, household appliances, physical elements of protection against intrusions to them. At the same time, it is extremely important to ensure the information security of the CFS. To ensure the required level of their security, it is necessary to effectively solve the problems of managing the process of ensuring their information security. The article proposes an approach to the development of a model for the information security management process of a CFS operating in a smart home.

Науково-методичні засади оцінки ефективності процесу управління інформаційною безпекою підприємств малого та середнього бізнесу: кібербезпека та інтелектуальна власність

The aim of the article is to study the scientific and methodological foundations of assessing the efficiency of the information security management process of small and medium-sized businesses and develop recommendations for improving its efficiency in the face of growing challenges and threats to cybersecurity and intellectual property. The main research methods were: analysis, synthesis, generalization, tabular, graphical, and integrated approach. The importance and necessity of timely assessment of the efficiency of the information security management process of small and medium-sized businesses due to the growing cyberthreats to their intellectual property as a basis for innovative development in a pandemic, war, digitalization was highlighted. The process of information security management for the protection of intellectual property (IPR) was substantiated as a reliable basis for innovative development of small and medium-sized businesses. Emphasis is placed on the growing importance, role and importance of cybersecurity for the functioning and development of small and medium-sized businesses in the face of new challenges and threats. A scientific and methodological approach to assessing the efficiency of the information security management process in the context of IPR protection of small and medium-sized enterprises in the conditions of a growing number of challenges and threats has been developed and proposed for use. Emphasis was placed on the expediency of a detailed study of directions for improving the regulatory framework for information security to protect the IPR of small and medium-sized businesses in the face of countering the cyber threats. Prospective directions of research on this issue were highlighted: development of information security strategy for IPR protection in the context of prevention of new challenges and threats; improving the organizational aspects of information security management for the protection of IPR; development of digital culture of small and medium-sized businesses as a factor in improving the efficiency of the information security management process in the face of digitalization challenges.

Selecting Best Software Vulnerability Scanner Using Intuitionistic Fuzzy Set TOPSIS

Software developers endeavor to build their products with the least number of bugs. Despite this, many vulnerabilities are detected in software that threatens its integrity. Various automated software i.e., vulnerability scanners, are available in the market which helps detect and manage vulnerabilities in a computer, application, or a network. Hence, the choice of an appropriate vulnerability scanner is crucial to ensure efficient vulnerability management. The current work serves a dual purpose, first, to identify the key factors which affect the vulnerability discovery process in a network. The second, is to rank the popular vulnerability scanners based on the identified attributes. This will aid the firm in determining the best scanner for them considering multiple aspects. The multi-criterion decision making based ranking approach has been discussed using the Intuitionistic Fuzzy set (IFS) and Technique for Order of Preference by Similarity to Ideal Solution (TOPSIS) to rank the various scanners. Using IFS TOPSIS, the opinion of a whole group could be simultaneously considered in the vulnerability scanner selection. In this study, five popular vulnerability scanners, namely, Nessus, Fsecure Radar, Greenbone, Qualys, and Nexpose have been considered. The inputs of industry specialists i.e., people who deal in software security and vulnerability management process have been taken for the ranking process. Using the proposed methodology, a hierarchical classification of the various vulnerability scanners could be achieved. The clear enumeration of the steps allows for easy adaptability of the model to varied situations. This study will help product developers become aware of the needs of the market and design better scanners. And from the user's point of view, it will help the system administrators in deciding which scanner to deploy depending on the company's needs and preferences. The current work is the first to use a Multi Criterion Group Decision Making technique in vulnerability scanner selection.

О ВОЗМОЖНОСТИ ЧИСЛЕННЫХ МЕТРИК В УПРАВЛЕНИИ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТЬЮ

Introduction. The existing information security management in information systems is a set of informal verbal models. They make it possible to determine a variety of measures but cannot conduct numerical assessments – to compare alternative strategies according to the introduced criterion, to numerically record changes in the level of information security, to perform mathematically justified optimization of control actions. Purpose: The purpose of the study is to substantiate the possibility of using numerical estimates in information security management. Methods: The search for alternative methods of modeling information security management processes begins with the modeling object classification. The modeling object (the information security management process) is considered as a complex system having irremediable uncertainty. A method using fuzzy algorithms can be classified as one of the possible methods in modeling such objects. Fuzzy algorithms are most widely used when modeling technical control systems, but this method potential allows us to hope for positive results when modeling more complex processes. The article offers an example of using fuzzy modeling algorithms based on Mamdani rules of inference algorithms for creating an information security management system model of an information system. Results: The sensitivity, continuity and qualitative adequacy of the described model are substantiated, the possibility of operational tracking of the influence of destabilizing influences on the level of information security in the information system using a numerical metric is shown. Practical relevance: The use of the proposed methods opens up the possibility of building an automatic information security management system of an information system.

ПРОДОВОЛЬЧА БЕЗПЕКА: ПІВНІЧНО-АРКТИЧНА СПЕЦИФІКА

In the context of increasing demand for food with limited agricultural resources, there is a widespread search for additional sources of biologically full-fledged local food. This also applies to the northern and Arctic territories. The purpose of the article is to consider the features of ensuring food security of the population of the northern and Arctic territories. The subject of the study is the process of food security management. The research methods used were analytical, historical, statistical, logical, and comparative. The research hypothesis. Regulation of the production of local agricultural products, the creation of enterprises for its processing, storage and sale of food, the formation of rear food bases in adjacent, favorable agricultural zones, the delivery of food from other regions of the country will eliminate the dependence of the population of the northern and Arctic territories on imported food, reduce losses and improve its quality. Summary of the main material. The content of food security is considered. Its main elements, including food independence, physical and economic accessibility of food for all social groups of the population, and food safety for consumers, are established. The current state of food independence is characterized. The northern and Arctic specifics of ensuring food security are revealed. The analysis of self-sufficiency of the population of the North and the Arctic with agricultural products is given. The risks and threats to food security have been identified. Measures to overcome them are considered. Practical value. The recommendations and suggestions can be used in the development and adjustment of State programs for the development of the agri-food sector and rural areas by the subjects of the Northern and Arctic zones, as well as in the further research work of the author. Conclusions of the study. The study of the specifics of the food supply of the population in extreme natural conditions will allow state and local authorities to effectively manage food security.

SECURITY MANAGEMENT OF THE POLDA METRO JAYA COMMAND HEADQUARTERS IN ANTICIPATING DEMO ANARCHIST

This study discusses the process of tactical security efforts at Polda Metro Jaya Command Headquarters which focus on security, analysis of constraints and impacts faced in implementing physical security management at Polda Metro Jaya Command Headquarters in anticipation of anarchic demonstrations. This research was conducted using qualitative methods and using the Theory of Security Management Theory of Physical Security. This study found that the Police's efforts in securing the implementation of physical security management at Polda Metro Jaya Command Headquarters are still not optimal. The government needs to make improvements and additions in the form of a security management process through the integration of elements of planning, organization, implementation as well as supervision and control. First, the implementation of physical security management at the Polda Metro Jaya Command Headquarters currently includes a security management process, a physical security process and a tactical security process. The security management process consists of elements of planning, organizing, executing and supervising and controlling. Meanwhile, the physical security process consists of security personnel, access control, fences, locks, lighting and guard posts. Constraints in the security management process include the lack of maximal some elements in the security management process. Meanwhile, the constraints in the physical security process are in the form of a lack of proper functioning of the existing physical security components and the absence of several other physical security components at this time. The third effort to safeguard the implementation of physical security management at the Polda Metro Jaya Command Headquarters is expected, in the form of improvements and additions. Meanwhile, the improvement of several physical security components currently consists of security officers, access control, fences, locks, lighting and guard posts. Meanwhile, the addition of several physical security components currently consists of barriers, CCTV and communication devices.KEYWORDS: Security Management, Polda Metro Jaya Headquarters, Anarchist Demo Background

The Global Cyber Security Model: Counteracting Cyber Attacks through a Resilient Partnership Arrangement

In this paper, insights are provided into how senior managers can establish a global cyber security model that raises cyber security awareness among staff in a partnership arrangement and ensures that cyber attacks are anticipated and dealt with in real time. We deployed a qualitative research strategy that involved a group interview involving cyber security and intelligence experts. The coding approach was used to identify the themes in the data and, in addition, a number of categories and subcategories were identified. The mind map approach was utilized to identify the thought processes of senior managers in relation to ensuring that the cyber security management process is effective. The global cyber security model can be used by senior managers to establish a framework for dealing with a range of cyber security attacks, as well as to upgrade the cyber security skill and knowledge base of individuals. In order for a cyber security mentality to be established, senior managers need to ensure that staff are focused on organizational vulnerability and resilience, there is an open and transparent communication process in place, and staff are committed to sharing cyber security knowledge. By placing cyber security within the context of a partnership arrangement, senior managers can adopt a collectivist approach to cyber security and benefit from the knowledge of external experts.

Автоматизация обработки данных в процессе аудита информационной безопасности

According to the Russian standards in the field of information security management (IS), which are authentic international standards, such as [1, 2], the organization must regularly conduct an internal audit of the information security management system. An audit is an independent review and evaluation of an organization's activities by analyzing and evaluating processes, projects, reports, and products. Audit, as an activity, is not static, unchanging, it evolves. From the point of view of leading international audit companies, in particular [3, 4], the current stage of audit evolution is the transition from reactivity (identifying shortcomings after the fact) to proactivity (predicting the results of actions or events before their completion). The validity of the statement for the Russian Internal Audit is confirmed by the results of the IX National Scientific and Practical Conference [5]. The movement towards proactivity in the audit determines the relevance of the following tasks: 1) processing up to 100 % of the information generated by the activity that is the focus of the audit; 2) processing information in a close-to-online mode; 3) the availability of powerful tools for data analysis and modeling on their basis the further development of the investigated events, as well as the appropriate skills of working with it from the auditors. When conducting audits, the auditors have a dilemma – on the one hand, they are obliged to provide the owners/shareholders/management of the organization with data as close as possible to the reliable state of the information security management processes, information about the identified shortcomings and recommendations for their elimination, on the other hand: the audit time is strictly limited; unloading the initial data from the organization's information systems takes considerable time; the data obtained from various information systems and other sources have different, not always standard formats; the tools used have disadvantages, since the most frequently used spreadsheets (MSExcel, LOCalc), due to internal limitations, are no longer able to provide the required functionality. The above-mentioned factors, as well as other factors, such as unwillingness to cooperate, hidden opposition of the personnel of the audited organization, evaluation of the work of auditors only by quantitative indicators (the number of observations or the time spent on one observation), lead to the fact that the checks are carried out superficially. At the same time, shortcomings in the information security management processes can be detected, but it becomes difficult to explain their nature and give effective recommendations to the business auditor. As a result, the goal of independent audits defined in GOST ISO/IEC 27002-2012 – “ensuring confidence in the continued efficiency, adequacy and effectiveness of the organization's approach to information security management” [2] – cannot be achieved. One of the options for eliminating some of the above-mentioned shortcomings is the use of programs developed by the auditors themselves and designed for operational data processing, the so-called “small automation”, during audits. This approach, although it is a low-level link in the chain of automation of audit procedures and, nevertheless, is within the framework of the audit development paradigm in the direction of robotization of procedures and the use of artificial intelligence, which is discussed, for example, in the works [3, 6, 7], and also confirmed by the results of conferences of the Institute of Internal Auditors [8].