METHOD FOR FORMING THE FUNCTIONAL SECURITY PROFILES OF SECTORAL INFORMATION AND TELECOMMUNICATION SYSTEMS
DOI:
https://doi.org/10.28925/2663-4023.2021.11.166182Keywords:
information and telecommunication systems, critical infrastructure, critical infrastructure object, cybersecurity, security assessment, functional security profile.Abstract
Global trends to increase and improve the quality of cyber attacks have led to the actualization of the protection of information and telecommunications systems (ITS), in particular, sectoral, which are critical for the functioning of society, socio-economic development and ensuring the information component of national security. Taking into account the needs of national security and the need to introduce a systematic approach to solving problems of critical infrastructure protection, at the national level, the creation of protection systems for such infrastructure is one of the priorities in reforming the defense and security sector of Ukraine. Thus, there is a need to develop methods and models for classifying ITS as critical infrastructure to ensure the national security of Ukraine. The paper proposes a structural-functional method for determining the functional security profile of the subsystem of the sectoral ITS, which allows to determine the basic functional security profile of the sectoral ITS by determining the sectoral requirements for confidentiality, integrity, accessibility and observability and more fully formulate criteria for assessing the security of information circulating in critical ITS. The study was followed by an experimental study on the example of ITS of the National System of Confidential Communication, which tested the adequacy of the method's response to changes in input data.
Downloads
References
On the main ambush of the cybersecurity of Ukraine, Law of Ukraine No. 2163-VIII (2020) (Ukraine). https://zakon.rada.gov.ua/laws/show/2163-19
About the Strategy of the Cybersecurity of Ukraine, Decision for the sake of the National Security and Defense of Ukraine (2016) (Ukraine). https://zakon.rada.gov.ua/laws/show/n0003525-16
On the seizure of information in information and telecommunication systems, Law of Ukraine No. 80/94-VR (2020) (Ukraine). https://zakon.rada.gov.ua/laws/show/80/94-vr
On the seizure of personal tributes, Law of Ukraine No. 2297-VI (2020) (Ukraine). https://zakon.rada.gov.ua/laws/show/2297-17
About the consolidation of Zagalnyh vimog to the cyber defense of critical infrastructure, Resolution of the Cabinet of the Ministry of Ukraine No. 518 (2019) (Ukraine). https://zakon.rada.gov.ua/laws/show/518-2019-п
ND TZI 3.7-003-05 The procedure for carrying out work from the establishment of a complex system and retrieval of information in the information and telecommunication systems // DSTSZI SB of Ukraine. - 2005.
ND TZI 2.5-004-99 Criteria for assessing the seizure of information in computer systems due to unauthorized access // DSTSZI SB of Ukraine. - 1999.
Sounds about NDR “Pre-Session and Analysis of Problems to Obtain Information on Critical Infrastructure Objects”, code “Infrastructure” (file number 0114U000038d).
Gonchar, S., Leonenko, G., & Yudin, O. (2013). Analysis of threats and vulnerabilities of industrial automated control systems. Legal, normative and metrological safety of the system and the source of information in Ukraine, 2 (26), 9-14.
Leonenko, G., & Yudin, A. (2013). Problems of ensuring information security of systems of critical information infrastructure of Ukraine. (pp. 44–49).
On the National Confidentiality System, Law of Ukraine No. 2919-III (2014) (Ukraine). https://zakon.rada.gov.ua/laws/show/2919-14
Nutritional arrangements for the organization of information exchange in the National Confidential System, Resolution of the Cabinet of Ministries of Ukraine No. 303 (2015) (Ukraine). https://zakon.rada.gov.ua/laws/show/303-2015-п
Decree of the President of Ukraine dated 04/18/2005 No. 663 "On the safety of the poor communication of the townspeople".
Order of the Administrative Department of State Specialized Communications dated 05/18/2015 No. 07 "On the consolidated instructions for organizing technical exploitation of the net and complexes of the state system and the level of security of Ukraine."
Sounds about the PDR "Designation of paths of special systems and unified communications in the interests of subscribers of state bodies, installation and organization", code "Platform"
ND TZI 2.5-005-99 Classification of automated systems and standard functional profiles of seized information from unauthorized access // DSTSZI SB of Ukraine. - 1999.
National Institute of Standards and Technology Special Publication 800-53A. Guide for Assessing the Security Controls in Federal Information Systems and Organizations: Building Effective Security Assessment Plans. June 2010.
National Institute of Standards and Technology Special Publication SP800-53. Security and Privacy Controls for Federal Information Systems and Organizations. April 2013.
DSTU ISO / IEC 27002: 2015 Information technology. I will get it. Star of practice for entering information security.
ISO / IEC 15408-1: 2009 Information technology - Security techniques - Evaluation criteria for IT security - Part 1: Introduction and general model // The International Organization for Standardization and The International Electrotechnical Commission. - 2009.
ND TZI 2.6-002-2015 The procedure for introducing functional components without baking, in accordance with ISO / IEC 15408, with vimogs ND TZI 2.5-004-99 // Derzhspetszvyazku. - 2015.
ND TZI 2.6-003-2015 The order of insertion of components until they are safe, according to ISO / IEC 15408, with the help of ND TZI 2.5-004-99 // Derzhspetsvyazku - 2015.
ND TZI 2.7-013-2016 Methodical instructions for reporting the results of assessments to the information officer regarding unauthorized access to the statement of information to ISO / IEC 15408 statements in accordance with 2.54- TZІ - 2016.
Yudin, A. (2018). Structurally logical and functional model of assigning the functional profile of the security of the information and telecommunication systems. (p. 50-51).
