DECISION-MAKING ON THE BASE OF LINEAR OPTIMIZATION IN THE PROCESS OF MANAGEMENT OF INFORMATION SECURITY RISKS
DOI:
https://doi.org/10.28925/2663-4023.2024.25.330343Keywords:
decision-making; information security; information security risks; information security risk management; linear optimization.Abstract
Information security is a critical field in which many different factors and constraints must be taken into account to ensure that data and infrastructure are protected. One of the main challenges in this area is the optimal allocation of limited resources between different security measures, which requires the use of mathematical methods to find optimal solutions. This article discusses the use of linear programming methods to solve problems related to optimizing the costs of information security risk reduction measures. The article reviews scientific sources on the applied aspect of linear programming for risk assessment and information security risk management. The article shows the process of building a model based on a linear programming problem, starting with the formalization of the problem, selection of the objective function and constraints, and ending with obtaining an optimal solution with its analysis and interpretation. The model in the form of a linear programming problem allows optimizing the total costs of information security, taking into account the chosen direction of optimization and given the given constraints on resources - budget, time, technical and other. The article presents the use of linear optimization based on the SWOT analysis of information security risks, which allows organizations to systemize and specify the risk management process, directing limited resources to the most critical areas and ensuring optimal protection of data and information systems. The obtained results show that the use of linear programming methods allows to achieve a significant optimization of information security costs, providing a high level of protection. Among the promising directions for further research are multi-criteria optimization and dynamic planning with consideration of time changes in risks and costs. This study can be used as an illustrative example of intersubject connections of the disciplines of the specialty 125 Cybersecurity and information protection in the educational activities of students of this specialty.
Downloads
References
Shevchenko, S., Zhdanovа, Yu., Spasiteleva, S., Negodenko, О., Mazur, N., Kravchuk, К. (2019). Mathematical Methods in Cybersecurity: Fractals and their Applications in Information And Cyber Security. Cybersecurity: education, science, technique, 1(5), 31–39.
Shevchenko, S., Zhdanovа, Yu., Skladannyi, P., Spasiteleva, S., (2021). Mathematical Methods in Cibersecurity: Graphs and their Application in Information and Cybernetic Security. Cybersecurity: education, science, technique, 1(13), 133–144.
Shevchenko, S., Skladannyi, P., Negodenko, О., Negodenko, V. (2022). Study of applied aspects of conflict theory in security systems. Cybersecurity: education, science, technique, 2(18), 150–162.
Shevchenko, S., Shevchenko, H., Zhdanova, Y., Spasiteleva, S., & Negodenko, O. (2023). Conflict Analysis in the Information Security System: Subject – Subject. CEUR Workshop Proceedings, 3421. 56–66.
Shevchenko, S., Zhdanovа, Yu., & Spasiteleva, S. (2023) Mathematical Methods in Cybersecurity: Catastrophe Theory. Cybersecurity: education, science, technique, 3(19), 165–175.
Shevchenko, S., Zhdanovа, Yu., Skladannyi, P., & Boiko, S. (2023) Game Theoretical Approach to the Modeling Of Conflicts in Information Security Systems. Cybersecurity: education, science, technique, 2(22), 168–178.
Shevchenko, S., Zhdanovа, Yu., Spasiteleva, S., Mazur, N., Skladannyi, P., & Negodenko, V. (2024). Mathematical Methods in Cyber Security: Cluster Analysis And its Application in Information and Cybernetic Security Cybersecurity: education, science, technique, 3(23), 258–273.
Korniyenko, B., Galata, L., Ladieva, L. (2019). Mathematical Model of Threats Resistance in the Critical Information Resources Protection System. CEUR Workshop Proceedings, 2577, 281–291.
Lysenko, N. O., Mazurenko, V. B., Fedorovych, A. I., Astakhov, D. S., Statsenko, V. I. (2021). Review of Mathematical Methods in Cyber Threat Detection and Prevention Systems. Actual problems of automation and information technologies, 2021(25), 91–102. http://dx.doi.org/10.15421/432110
Khoroshko, V., Brailovskyi, M., Khokhlachova, Y., Vyshnevska, N. S. (2023). Mathematical Models And Algorithms For Determining Time Decision-Making In The Cyber Defense System. Scientific and Practical Cyber Security Journal (SPCSJ), 7(3), 11–16.
Sobchuk, V., Barabash, O., Musienko, A., Tsyganivska, I., & Kurylko, O. (2023) Mathematical Model of Cyber Risks Management Based on the Expansion of Piecewise Continuous Analytical Approximation Functions of Cyber Attacks in the Fourier Series. Axioms, 12(10).
Lieberman, G. J., & Hillier, F. S. (2010). Introduction to Operations Research.
Bazaraa, M. S., Jarvis, J. J., & Sherali, H. D. (2010). Linear Programming and Network Flows – 4th ed. Wiley.
Jain, S., & Mukhopadhyay, A. (2023). Optimization of Investments in Cybersecurity: A Linear Programming Approach. WISP 2023 Proceedings 8.
Enayaty-Ahangar, F., Albert, L. A., & DuBois, E. (2020). A survey of optimization models and methods for cyberinfrastructure security. IISE Transactions, 53(2), 182–198.
Hong, Y., Vaidya, J., Rizzo, N., & Liu, Q., (2016). Privacy Preserving Linear Programming. https://doi.org/10.48550/arXiv.1610.02339
Talabis, M., & Martin, J. (2012). Information Security Risk Assessment Toolkit: Practical Assessments through Data Collection and Data Analysis. Newnes.
Chinemeze, A. K., Mbam, B. C. E. (2019). Impact of Risk Management on Software Projects in Nigeria Using Linear Programming. American Journal of Engineering Research (AJER), 8(7), 186–192.
Feng, N., Wang, H. J., & Li, M. (2021). A security risk analysis model for information systems: Causal relationships of risk factors and vulnerability propagation analysis. Reliability Engineering & System Safety, 256, 57–73. https://doi.org/10.1016/j.ins.2013.02.036
White, J. (2014). Security Risk Assessment. https://www.perlego.com/book/1830498/security-risk-assessment-managing-physical-and-operational-security-pdf
Ridley, D., Llaugel, F., Daniels, I., & Khan, A. (2022). Study on Linear Programming in Risk Management. Novel Research Aspects in Mathematical and Computer Science, 1, 151–161
Mohammed, A. R, & Kassem, S. S. (2020). Product Mix Optimization Scenarios: A Case Study for Decision Support Using Linear Programming Approach. International Conference on Innovative Trends in Communication and Computer Engineering (ITCE), 50–55. https://doi.org/10.1109/ITCE48509.2020.9047758
Martynenko, M. A., Neshchadym, O. M., & Safonov, V. M. (2010). Mathematical programming: Textbook. K.: NUHT.
Shevchenko, S., Zhdanovа, Yu., Spasiteleva, S., Skladannyi, P., (2020). Conducting a SWOT-analysis of information risk Assessment as a means of formation of practical skills of students specialty 125 Cybersecurity. Cybersecurity: education, science, technique, 2(10), 158–168.
Shevchenko, H., Shevchenko, S., Zhdanova, Yu., Spasiteleva, S., & Negodenko, O. (2021). Information Security Risk Analysis SWOT. CEUR Workshop Proceedings, 2923, 309–317.
Published
How to Cite
Issue
Section
License
Copyright (c) 2024 Юлія Жданова, Світлана Шевченко, Світлана Спасітєлєва, Олег Сокульский
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
