METHOD FOR CALCULATING THE LEVEL OF CYBERSECURITY OF CRITICAL INFORMATION INFRASTRUCTURE FACILITIES

Abstract

In today's world, where the number and complexity of cyber threats, especially those targeting strategic state assets, are growing rapidly, there is an urgent need to develop effective, flexible, and adaptive mechanisms for assessing the current level of cyber security. In view of this need, an analysis of existing approaches to assessing the level of cyber security was conducted. Among them are models based on maturity, risk, and compliance. The results of the analysis showed that none of these approaches is completely universal or sufficient for a comprehensive assessment of critical information infrastructure objects in the context of the national legislative field. In particular, approaches based solely on compliance may not take into account real risks, while approaches based on maturity are often too subjective. To address these systemic shortcomings, a hybrid approach was proposed. This approach integrates the best features of previous models, combining the objectivity of compliance testing, the flexibility and process orientation of maturity assessment, and risk-based prioritization. Based on the hybrid approach, a method for calculating the level of cyber protection of critical information infrastructure objects was developed. A component of this method is the introduction of weighting coefficients for different criteria systems. To determine these weighting coefficients, which should ensure an objective reflection of expert knowledge, the hierarchy analysis method was chosen. The proposed method allows qualitative characteristics (e.g., binary “yes/no” answers) to be transformed into a single quantitative indicator. This indicator is calculated in a standardized range from 0 to 1, which facilitates comparison and monitoring. The resulting numerical value is further interpreted on a five-level maturity scale (from “Initial” to “Optimized”), which provides a clear idea of the steps needed for improvement.

Thus, the developed method is hierarchical, multi-criteria, and adaptable to current Ukrainian legislation in the field of cyber protection and cyber security.

In further research, it is planned to conduct an experimental study and verify the method on three critical infrastructure objects in the fuel and energy sector, as well as to compare the results obtained using the author's software and two other tools.