FORECASTING THE SECURITY INDEX OF COMPUTER NETWORKS USING ECONOMETRIC MODELS

Abstract

The article considers a comprehensive approach to predicting the security index of local computer networks of organizations using modern econometric tools. The main attention is paid to the adaptation of classical production functions, in particular the Cobb–Douglas model, to the sphere of information security. The application of two modifications of the Cobb–Douglas production function — linear and nonlinear forms — is proposed to model the impact of key factors on the level of security of information infrastructure. The econometric models presented in the study take into account the impact of investments in cybersecurity, human capital, as well as technical and software protection tools used within organizational information systems. In particular, the following independent variables are included in the model: the amount of investment in security hardware (for example, firewalls, firewalls, routers with security functions), the cost of security software (intrusion detection and prevention systems, antivirus, SIEM), as well as parameters characterizing the human factor, in particular the number of information security specialists involved in the enterprise. The article provides a theoretical justification for the choice of the model, identifies the main endogenous and exogenous variables, analyzes their impact on the resulting variable, and also considers approaches to collecting, validating, and pre-processing empirical data. An econometric model was built based on real data collected from a number of organizations of various profiles, which made it possible to test the model in real conditions. The estimation of model parameters was carried out using multiple regression methods using the Statistica econometric analysis software. The modeling results confirmed the feasibility of using Cobb–Douglas functions in the field of cybersecurity and made it possible to combine the volumes of input data to model the future situation and determine the overall level of security of organizational networks. The conclusions obtained can be useful for forming an effective information security management policy, optimizing costs for cyber protection, as well as for strategic planning of investments in the development of information infrastructure. The proposed approach is flexible and scalable, which allows it to be adapted to the specifics of individual industries or organizations.