Security Of Information Resources Research Articles

Security policy of the critical information infrastructure of Russia and its legal support

The Doctrine of Information Security of the Russian Federation of 2016 notes the importance of ensuring the stable and uninterrupted functioning of the information infrastructure in peacetime, during a period of imminent threat of aggression, as well as in wartime. The purpose of protecting critical information infrastructure facilities is to ensure their stable operation in various modes of operation in the face of information security threats. The methodological foundations were the use of general scientific methods of research — analysis and synthesis of information. The sources for this study were scientific articles by Russian scientists and practitioners on information security issues. An interdisciplinary approach was used to achieve the goals of this article. A detailed analysis of the key concepts and theoretical provisions of the policy of ensuring the security of information resources, as well as a comparative analysis of various approaches.

Identifying and evaluating the challenges facing the management of digital libraries

Background and purpose: With the advancement of science and the increase of electronic resources, the need to create libraries to collect, organize and disseminate these types of resources is felt. With the growth of electronic resources, resource management has gained special importance and is one of the important areas and issues in the discussion of digital libraries. In this study, the aim is to examine the issues and challenges facing the management of digital libraries and provide solutions to solve the challenges and issues facing digital libraries and digital library management. Research method: The current research is applied in terms of purpose and survey research in terms of method. The current research has been conducted by field method and using library techniques, and the researchers have presented digital library management approaches by reviewing the published texts on digital libraries and digital library management issues. Findings: The results of the research showed that the most important components of digital library management include human resources, management of shared resources, author's right to update resources, cataloging and maintaining the technical structure. Also, the surveys showed that the most important challenge facing digital libraries is the issue of intellectual property and compliance with copyright laws. Conclusion: The results of the research showed that in digital libraries, as in traditional libraries, measures must be taken in the field of collecting, organizing, storing and disseminating information, and it is not possible to carry out the above-mentioned activities without a competent manager. Digital library management leads to the creation of coordination between different parts of the digital library and helps the library to achieve the desired goals. The digital library is facing many issues and challenges, including financial and budget issues, issues related to expert human resources, issues related to digital equipment and internet infrastructure, issues related to author's right and copyright, issues related to the lack of devices. Digitization and security of important information resources and documents and finally issues related to the protection and maintenance of digital resources are faced, which cannot be solved except with the presence of a capable manager and strong human resources of the library.

A COMPARATIVE EVALUATION OF THE BOOSTING ALGORITHMS FOR NETWORK ATTACK CLASSIFICATION

The security of information resources is an extremely critical problem. The network infrastructure that enables internet access, in particular, may be targeted by attackers from a variety of national and international locations, resulting in losses for institutions that utilize it. Anomaly detection systems, sometimes called Intrusion Detection Systems (IDSs), are designed to identify abnormalities in such networks. The success of IDSs, however, is limited by the algorithms and learning capacity used in the background. Because of the complex behavior of malicious entities, it is critical to adopt effective techniques that assure high performance while being time efficient. The success rate of the boosting algorithms in identifying malicious network traffic was studied in this study. The boosting approach, one of the most used Ensemble Learning techniques, is accepted as a way to cope with this challenge. In this work, Google Colab has been used to model well-known boosting algorithms. The AdaBoost, CatBoost, GradientBoost, LightGBM, and XGBoost models have been applied to the CICID2017 dataset. The performance of the classifiers has been evaluated with accuracy, precision, recall, f1-score, kappa value, ROC curve and AUC. As a result of the investigation, it was discovered that the XGBoost algorithm produced the greatest results in terms of f1-score, with 99.89 percent, and the AUC values were extremely near to 1, with 0.9989. LightGBM and GradientBoost models, on the other hand, have been shown to be less effective in detecting attack types with little data.

Информационные и телекоммуникационные ресурсы критически важных инфраструктур: особенности интервального анализа защищенности

The object of the research is a new methodological approach to solving the problem of interval analysis 
 of the security of information and telecommunication resources of critical infrastructures. This approach is one of the variants of practising the methods of the class midvalues (interval calculations). The approach characteristics were analyzed to determine its validity and usefulness for assessing the security indicators of such complex technical systems over a time interval. There have been considered theoretical aspects of building the algorithms for calculating the class midvalues of security levels of information and telecommunication resources of critical infrastructures, factors of calculating the upper and lower class midvalues of security levels. A sequence of calculations and analytical expressions for calculations on the example of a specific security indicator are proposed. The approach offers taking into account the modern requirements of security management subsystems of complex technical systems, the requirements of officials (auditors, security administrators) related to the inertia of decision-making processes, with the duration of cycles of security control and security management of systems of this class. It allows one to obtain not point (instantaneous), but interval estimates of security indicators, while the analysis is carried out with a predetermined frequency and takes into account the uncertainty of the initial data – observed and controlled security indicators. At the same time, interval analysis does not have great mathematical and computational complexity, but it allows one to obtain interval estimates of resource security adequate to control and management tasks, saves computing resources and, ultimately, works 
 to increase the reliability of security control of modern critical infrastructures

ІНФОРМАЦІЙНА ТА ЕКОНОМІЧНА БЕЗПЕКА: ОЦІНЮВАННЯ РІВНЯ ТА ВЗАЄМОЗВ’ЯЗКУ

Abstract. The article is devoted to the study of a comprehensive assessment of the level of information security as a basis for timely and reasonable determination of measures to pre-vent and overcome the negative consequences in the event of potential risks and threats. It is substantiated that in the context of information and hybrid wars, strengthening information se-curity is a prerequisite for the protection of national economic interests. The formation of a security-oriented information environment, ensuring the security of state information re-sources, information with restricted access, in particular that circulating on the objects of eco-nomic information infrastructure is the basis of the national security of the country. The absence of a unified approach to assessing the level of information security is noted and the author's approach based on the use of qualitative indicator indicators of information security with the use of quantization, smoothing and normalization methods is proposed. It is proposed to define the following subindices of the integral indicator of information security: development of the state policy in the field of information security; monitoring and analysis of threats to the infor-mation environment; education and advanced training in the field of information security, in-cluding cyberspace; contribution to global information security, protection of digital services and basic services in cyberspace, electronic identification services, personal data protection; fight against cybercrime and military cyber operations. The results of the correlation and re-gression analysis made it possible to establish that information and economic security have the potential to provide synergistic effects. The necessity of ensuring the formation of a secu-rity-oriented information environment as a basis for the realization of national interests is sub-stantiated, which creates new opportunities for strengthening the security of the national econ-omy in the face of increasing influence of internal and external destabilizing factors

Communication Security Analysis of Intelligent Transportation System Using 5G Internet of Things From the Perspective of Big Data

The transportation system has entered the era of 5G intelligent Internet of things (IoT), which can realize the comprehensive monitoring, perception, and intelligent decision-making of people, vehicles, roads, and the environment. The purpose is to solve the problems in the communication security of intelligent transportation system (ITS) and improve the vulnerability of traditional distributed architecture. The security issues of the Internet of vehicles (IoV) in 5G environment are analyzed from the perspective of big data. An access control mechanism based on risk prediction is proposed aiming at the problems existing in the node access control process. A Wasserstein Distance-based Combined Generative Adversarial Network (WCGAN) is proposed. It modifies the loss function to solve the gradient disappearance problem, and a combination of multiple generators is designed to solve the pattern collapse. The simulation experiment is carried out on the dataset of the intrusion detection evaluation project. The WCGAN model has the smallest prediction error than the other models regarding the node packet transmission rate. Its loss value is close to 0 after 10 iterations, while the loss value of the BP neural network (BPNN) is about 0.28. The prediction accuracy of the WCGAN model can reach 86.3% when the training set is 5000, which is much higher than that of BPNN (77.8%). The reason is that the WCGAN model increases the number of generators according to GAN, which improves the low accuracy caused by pattern collapse. The IoT-based ITS can implement corresponding strategies according to the prediction results and control the access rights of nodes, thus ensuring the security of information resources effectively. The research content reduces the communication delay under ensuring the integrity and confidentiality of information in the process of data transmission, and provides a reference for ensuring the safe communication of IoV.

Technologies of accounting, analysis and audit of settlements with suppliers, their impact on ensuring business continuity

Introduction. The constant dynamics of changes in the international situation around the war in Ukraine meant the deterioration of the economic environment and deepening of economic and political uncertainty, increasing threats to business. Thus, in the implementation of logistics schemes for the supply of inventory, the issue of effective management of settlements with suppliers becomes one of the priority tasks of the enterprise today. These issues are relevant to the ability of enterprises to fulfill their current obligations, comply with credit schedules and generally continue to function in conditions of information resource security. Reproduction of dynamic changes in the technology of accounting, analysis and audit of the timeliness of settlements with suppliers is a prerequisite for ensuring the continuity of enterprises and is possible with the use of the latest functional models in the economy. The purpose is to study the assumption of going concern in accounting and auditing, its regulation, technological tasks and the consequences of the impact on financial statements in terms of liabilities for settlements with suppliers; finding ways to solve the problems of accounting technology, analysis and audit of settlements with suppliers on a continuous basis, improving their organization in conditions of uncertainty due to the consequences of military operations. Method (methodology). Scientific methods and approaches were used in the work, in particular, comparison to study the principle of going concern in the domestic practice of accounting and auditing on the basis of international and domestic standards in terms of settlements with suppliers; formalization and generalization of the main technological tasks of accounting for settlements with suppliers in conditions of uncertainty about the ability of the entity to continue as a going concern. Results. The essence of the continuity of the enterprise in terms of settlements with suppliers is clarified; international and domestic standards as imperatives for the development of technology for accounting and auditing of liabilities for settlements with suppliers and their impact on financial reporting indicators are studied and analyzed. On the basis of the study, the problems of accounting for settlements with suppliers in conditions of uncertainty at domestic enterprises were identified; a number of potential issues for consideration by the auditor during the assessment were formulated; ways to solve them and ways to optimize them, in particular methods of debt management in order to strengthen payment discipline and reduce the risk of bankruptcy of the enterprise, were proposed.

The role of the organizational climate in the application of electronic administration in the faculties of Salahuddin University - Erbil

This thesis aims to study the role of the organizational climate in the application of electronic administration in the faculties of Salahuddin University - Erbil. The study was applied to the study society represented by the academic leaders of the faculties of Salahuddin University (95) of the deans of the colleges and their assistants and heads of departments. To collect data and information, the questionnaire is used. It sought to test a number of hypotheses related to correlation and influence between the variables of the study, in order to answer the questions related to the problem and reach the goals set. In order to analyze the data, many statistical methods were used, the most important of which were (descriptive statistics, correlation analysis, regression, variance analysis, t test). After analyzing the data statistically, the study reached a number of conclusions, the most important of which is that there is a good harmony between the organizational climate dimensions (organizational structure, communication, technology, participation in decision making, working conditions) and the average compatibility of the requirements of electronic administration Technical, administrative requirements, human requirements, and security requirements) in the responses of the sample members, as well as the existence of significant positive and moral relations between all the dimensions of the five organizational climate (combined and individual) There is a significant effect between the dimensions of the organizational climate (both individually and collectively) as independent variables and electronic management as a dependent variable. These results were consistent with the hypotheses of the study. Based on the findings of the study, the study came out with a number of recommendations, the most important of which are: attention to the organizational climate and review of its dimensions in the faculties of the University of Salah al-Din-Erbil, and work to enhance the positive aspects and address the negative aspects, as this has a major role in promoting the application of electronic administration, As well as providing (necessary technology, material and moral support, training courses, protection programs to ensure the security and safety of administrative information, technical and human resources required)

Analysis of information security issues in corporate computer networks

This article discusses the main problems associated with information security in corporate networks and ensuring the reliable operation of information systems and the services they provide. Information security is understood as the security of information resources and information systems, as well as the supporting infrastructure from accidental or deliberate influences of a natural or artificial nature, fraught with harm to the owners or users of information resources. Currently, there are major changes in information security issues. They relate to the methods of work of attackers, the conditions of crimes commited in the computer sphere, as well as the consequences of illegal activities.

МЕТОДИЧНИЙ ПІДХІД ДО АНАЛІЗУ ІНФОРМАЦІЙНИХ РЕСУРСІВ ПІДПРИЄМСТВА

The introduction of electronic means of communication in the management processes of the enterprise has led to a sharp increase in the number of information messages. There was a redistribution of working time in favor of solving information problems. As a result, information technology leads to negative effects and losses. The purpose of the study is to develop guidelines for improving the information support of the industrial enterprise on the basis of evaluation and management of information resources. It is proposed to evaluate the information resources of the enterprise in a pragmatic approach (qualitative assessment) for three groups of indicators – effectiveness, security and adequacy of information. Effectiveness is determined by the level of satisfaction of information needs and the ability to give the target effect. Security shows the level of automation, the state of use of information infrastructure, information literacy of staff, and financial security of information resources. Sufficiency is due to indicators of information quality, timeliness of receipt and use of information resources, the use of information models and a variety of sources of information resources. The method of calculation of the integrated indicator which allows to receive complex representation at once about all system of information maintenance of the enterprise is offered. Reflecting the efficiency of attracting and using information resources, the integrated indicator can serve as a signal indicator of the feasibility of updating information and modernizing the information system. When forming the list of signs it is necessary to consider that the qualitative sign can be presented by a set of equivalent nominations which are the list of possible names of quality. In this case, each nomination of a qualitative feature is placed in accordance with the quantitative value of the transformation function depending on the desirability scale. The transformation of partial indicators is proposed to be carried out by the geometric mean method. In addition to the method of forming an integrated indicator of evaluation of information resources, the expediency of using the method of analysis of hierarchies for making management decisions on the formation of the information system of the enterprise is substantiated. Thus, the method of integrated evaluation allows you to synthesize indicators of effectiveness, security and adequacy of information resources of the enterprise and on this basis to form the optimal structure and amount of information that takes into account economic needs and increases productivity.

MODELS AND METHODS OF IMPROVING THE EFFICIENCY OF WIRELESS ACCESS OF TELECOMMUNICATION SYSTEMS AND NETWORKS

The peculiarities of construction of complex information and telecommunication systems of special purpose are researched in the work, the general and special requirements to the applied telecommunication technologies are substantiated on the example of the automated territorially distributed system of the uniform regional operative and dispatching centers. To take into account certain properties of the generated authorization keys, a comprehensive model of authorization and authentication of wireless access is proposed for the security assessment of telecommunication systems and networks. The proposed territorial distribution systems of unified regional operational control centers for special purposes are based on the deployment of wireless telecommunication systems and must meet the basic requirements of users with high mobility. Consider the capabilities of these systems in terms of fulfilling special requirements for ensuring the security of national information resources, personal data, information with limited access and the security of communication protocols, etc. An analysis is carried out in the specification of IEEE 802.16 series standards on the use of various cryptographic protection mechanisms designed to provide various security services and security in wireless telecommunication networks, representing various attacks aimed at disrupting the operation of authentication and authorization protocols. The communication protocols used in the deployment and use of wireless telecommunication systems that provide an increased level of security, especially regarding the issues of unauthorized interception of transmitted data and unauthorized access to various telecommunication resources, and violations associated with false authentication of devices in relation to users of certain elements of telecommunication systems. Basic models of wireless telecommunication systems are proposed, which are deployed in accordance with the IEEE 802.16 specification and can be used to build various information systems for special purposes, including geographically distributed systems of unified regional operational control centers in Ukraine.

Цифровий компонент сучасного аудиту діяльності суб’єктів підприємницької діяльності

The article is aimed at substantiating organizational provisions and developing recommendations for improving the conceptual principles of projecting a computer-based audit system for the activities of performers of entrepreneurial activities. The article proposes the principles of modeling the audit system in the structure of the information service of entrepreneurs, provides proposals for assessing audit risks at different stages of entrepreneurial activity, substantiates methodological approaches to conducting an audit using modern information and communication technologies. It is proved that computer-based audit is an effective instrument for controlling and managing economic security of business entities. When designing the organizational-methodological structure of the audit, it is proposed to use the stages of audit development: confirming, system-oriented, and risk-based audit. When deciding on the creation and operational function of the computer-based audit of the activities of business entities, it is recommended to take into account their size, category, organizational and legal form of management, organizational structure, level of automation of accounting and control procedures. Scientific approaches using the proposed indicator of information security to assessing the state of information security of business entity are defined, their components are: degree of use of information and communication technologies in business processes, status of information threats, and degree of security of information resources. Methodical principles of auditing using modern information and communication technologies are proposed to strengthen control and analytical functions of management with the use of the latest audit systems. It is proved that computer-based audit covers the use of information technologies and software as a method and tools of the auditor in the process of performing the task on the basis of reliability assessment and identification of significant risks of the information system of a business entity.

Methods of synthesis and formation of a system of nonlinear discrete signals for modern information and communication systems

The paper presents the results of solving the urgent problem of improving the performance indicators of information and communication systems (ICS), in particular, information security, noise immunity, secrecy, the speed of formation and processing of information. The use of the distributed spectrum technology (broadband noise-like signals) is a promising direction for ensuring the security of information resources. The methods used for data formation and processing, as well as the classes of broadband signals used as physical data carriers, do not allow providing the necessary (especially for critical infrastructure facilities) indicators of information security and noise immunity. In this case, as discrete sequences (DS) that expand the spectrum (manipulate the carrier frequency), should be used DS based on nonlinear construction rules and having improved correlation, ensemble and structural properties. Methods for the synthesis and formation of nonlinear discrete complex signals, namely, the so-called cryptographic signals, are proposed. The first method, presented in the article, uses random (pseudo-random) processes. Another method is based on the implementation of the operation of decimation of the original discrete sequence of symbols obtained from the results of the implementation of the first method; it provides the synthesis of an ensemble of signals for a certain signal duration. Analytical expressions are obtained for determining the synthesis time of an ensemble of signals using the proposed methods. It is shown that the speed of the signal generation method based on the decimation operation for a certain signal duration is more than three orders of magnitude higher than the speed of the method based on the random (pseudo-random) processes used. At the same time, based on the carried out computer simulation, it is shown that the signals obtained using the proposed methods have identical correlation, ensemble, and structural properties.

Development of methodological principles for the construction of a corporate information-educational system of innovative-active university in the framework of anti-corruption activities

Innovative activity of universities and the formation of entrepreneur universities of the innovative type is one of the forms of integration of the higher education systems of countries into the world educational and scientific space, support of their competitiveness. Based on the separation of interaction between universities and the economy and society, an evolutionary model of the university’s interaction with stakeholders was developed. Understanding the new mission of universities made it possible to separate the dominants of activities of an innovative and active university (IAU), to develop a scheme of the interconnection of management processes and its basic functions. The authors’ interpretation of the IAU and the preconditions for constructing a corporate information and education system (CIES) was formed. Given the synergism and hybridity of modern cyber threats, the rise of corruption in the educational sphere, the Anti-corruption concept, which provides countering the elements of corruption and integrated hybrid threats through the construction of an adaptive information protection system (AIPS). The basis of corruption counteraction is the digital signature (DS) of the Key Certification Center (KCC) based on PKI (Public Key Infrastructure). To ensure the security of information resources (IR) of CIES, we proposed a model that makes it possible not only to take into consideration the synergy and hybridity of modern threats but also to form preventive anti-corruption measures. A model for providing anti-corruption measures that reflects the scenarios of the behavior of the participants of the corruption process and the anti-corruption bodies was developed. This makes it possible to assess the dynamics of the distribution of corruption deals over time and by the types of corruption to ensure the effective distribution of the university resources for anti-corruption activities

Security of Information Resources in Academic Libraries in Anambra State, Nigeria

Security of Information Resources in Academic Libraries in Anambra State, Nigeria

РЕКОМЕНДАЦІЇ ЩОДО ПОБУДОВИ ІНФОРМАЦІЙНО-ТЕЛЕКОМУНІКАЦІЙНИХ МЕРЕЖ НА ОСНОВІ ПОРІВНЯЛЬНОЇ ОЦІНКИ ЇХ СТІЙКОСТІ

The modern information environment is exposed to active cybernetic influence both on separate computer facilities, as well as on information and telecommunication systems and automated systems of state and military authorities that are aimed at interrupting the interrelated information properties: confidentiality, integrity and accessibility. Despite the introduction of various methods aimed at increasing the security of information resources in the information and telecommunication systems, the dynamics of the increase and the effects of cybernetic threats, both in the world and in Ukraine, remain rather high and constitute a world-class problem. In connection with this, there is an urgent need to ensure the effective functioning of heterogeneous information and telecommunication networks (ITN) of the Ministry of Defense and Armed Forces of Ukraine in the conditions of cyber attacks.The purpose of this article is to provide recommendations on the construction of information and telecommunication networks based on the comparative assessment of the stability of integrated computer networks (CN) structures, which allows to increase the reliability of the results of comparative evaluation of ICN structures with increasing number of elements and under conditions of influence on network nodes of unintentional and intentional obstacles by taking into account the long-term decrease in the values of complex indicators of the reliability of the nodes of the ICN.

Communication system information resource security breach model

The article presents a model of information resources security breach processed in communication systems. The basic functions of the security system as one of the elements of the communication system are described. It is shown that the vulnerabilities of its components lead to a violation of the security of information resources and contribute to the realization of threats to their security. The information resources security breach model is developed based on multiple vulnerabilities of communication systems. The list of security threats to information resources, attacks types at all levels of the basic reference model of open systems interaction, examples of attacks implementation and strategy of carrying out attacks by an attacker are considered: the impact of an attack option on a single object or multiple objects of the communication system, the impact of multiple attack options on a separate object or set of objects of a communication system. This allowed establishing the capabilities of the attacker when carrying out attacks on information resources of communication systems. The developed model is proposed to be used as a basis for building a subsystem of assessment of the security of information resources of the communication system. Also, methods of assessing the security of information resources against internal and external threats have been used. The security assessment subsystem of communication systems takes into account many possible threats and elements of communication systems. Based on the analysis of security threats to information resources and structural components of communication systems, analytical equations were obtained to assess the probability of realization of violations of the information resources security of communication systems at all levels of the basic reference model of open systems interaction. It has been found that the detection of attacks in communication systems depends on the speed at which the security system adapts to new threats. Using the obtained model of security breach will allow developing methods for assessing the level of protection against internal and external threats to determine the effectiveness of the information security system in real-time functioning. This will increase the overall security of the communication systems and information resources that they process

Determination of the required degree of data protection in automated control systems

The article considers the specifics of automated control systems for technological production and processes as objects of information security, proposed the approach to the decomposition of their components for further evaluation of the necessary degree of protection of the data they process. The method for obtaining the quantitative assessment of the grade of information resources security is presented. The proposed method allows taking into account the data value and the degree of criticality of violations of its integrity, accessibility and confidentiality for the functioning of the system. It can be used in practice at enterprises of various kinds of activity as an independent procedure, or as part of measures at the stages of preliminary analysis of automation systems before design or improving their data protection subsystems.

THE MODERN PRACTICES OF IMPLEMENTATION OF THE INFORMATION SECURITY AUDIT SYSTEM ON THE CRITICAL INFRASTRUCTURE OBJECTS

An integrated approach to the justification and implementation of the system of domestic and international standards, as well as regulatory and legal aspects of the formation of the information security audit system at critical infrastructure facilities and in the systems of state information resources is presented. It is determined that the information security management system is part of the overall management system of the enterprise and is designed to improve the state of information security. System "processing" and "risk-oriented" approach, which means that the main idea and the main task of the information security management system are the processes of analysis and management of information risks in the creation, implementation, operation, monitoring and support of the state of security of information resources of the company. The European approach to the audit system is based on a comparative analysis of the current state of the information system and ensuring the desired level of its effectiveness. In our country, is determined by the analysis and control of the information security management system of the enterprise on the model requirements of ISO 27001 \ ISO 270xx and a set of state standards of Ukraine ISO / IEC. Thus, a variety of standards in the field of information technology and information security management provides organizations with the opportunity to choose the methodology, the approach that best suits the features of business processes and the service market. Current criteria of quality assessment, as a set of requirements assessment of the effectiveness of the security features information; the methods and models of assessing the effectiveness of security features information as well as the presentation of the results of the processes of audit and control of information security are defined the methodology of the system of processing and analysis of information audit of information security in the critical infrastructure and treatment systems of the state information resources.

STRATEGY OF DETERMINATION OF THE HYPOTHETIC DIRECTION OF INCREASING THE RISK OF INFLAMMATION OF THE INFRASTRUCTURE SAFETY

In this article, a mathematical apparatus for comparative analysis of the set of threats of state information resources (DIR) is proposed for consideration, which combines methods and approaches to assess their qualitative and quantitative indicators. The main feature of the study is that the proposed approach to solving the problem of choice does not require a complete restoration of the principle of optimality, but allows to limit only information that will be sufficient to select the "reference sample". The essence of the ranking procedure lies in the fact that the expert poses the threat of an IP in the order that, in his opinion, is the most rational. For each of them the expert assigns specific numbers from a natural series - ranks. In this case, the highest rank receives the threat that has the highest priority. The order scale to be obtained as a result of ranking should satisfy the condition of equality of the number of ranks of the number of ranked threats. In this case, the less complex value of the numerical value will correspond to the least dangerous threat. The essence of the method lies in the fact that the expert must put each threat considered in a certain place in accordance with the degree of availability of one or another property, or in accordance with the proposed by the same expert, the coefficient of significance. In this case, the larger value of a complex assessment corresponds to the least dangerous threat. The basic mathematical method for assessing the threat of threats from the "general population" of the IB classes of threats is the method of formation and research of generalized indicators (criteria), the results of complex combination of which determine the trends of qualitative growth of their significance. Methods of expert assessments are used to increase the reliability of the results of assessing the levels of potential hazards of each threat from the "general population" of IB threat classes. The application of the proposed method will reduce the time to assess the state of the security of information resources and will allow, firstly, to identify the most significant threats that could inflict the greatest damage to information security and, secondly, to direct them the necessary means and safeguards.