Adaptive cybersecurity management model for information and communication systems based on a risk-oriented approach

Source abstract

The article addresses the problem of cybersecurity management of information and communi-cation systems under conditions of continuously changing threat parameters, the emergence of new vulnerabilities, and the growing number of cyberattacks. It is substantiated that traditional static approaches based on fixed security policies and predefined countermeasures do not ensure an adequate level of protection during the operation of information and communication sys-tems, as they fail to consider the dynamics of the threat environment, the transformation of as-set criticality, and changes in the probability of threat realization, which leads to the gradual accumulation of risks. An adaptive cybersecurity management model based on a risk-oriented approach is proposed. The model integrates security event monitoring, local asset risk assess-ment, formation of an integral risk indicator, selection and adjustment of countermeasures, and feedback mechanisms into a unified cyclic management process. The formalization of the mod-el is carried out using IDEF0 functional modeling and algorithmic description. Asset risk is de-fined as the sum of the products of the probability of relevant threat realization and potential damage, which is assessed using a multifactor scheme taking into account material, functional, and reputational losses. The integral risk indicator is formed as a weighted sum of local risks, considering asset criticality and established acceptability thresholds. The obtained results con-firm a reduction in both local and integral risks and demonstrate improved system responsive-ness to dynamic cyber threats compared to static security management models.