UNIFIED MODEL OF MATURITY OF NETWORK SECURITY CENTERS OF INFORMATION AND TELECOMMUNICATION NETWORKS

Abstract

In accordance with Decree No. 250 of the President of the Russian Federation, special structural units created by subjects of critical information infrastructure are able to counteract computer attacks on their information and telecommunication networks (ITCNs). In order to be effective, these units must have Network Security Centers (NSCs) of ITCN with a high level of maturity that meets the information security requirements for its owner organization. Currently, there is no single approach to assessing the NSC maturity level. Thus the article’s goal is to describe the developed Unified Maturity Model (UMM) of ITCN NSCs of organizations, created based on the generalization and development of the analyzed maturity models and authors' systematics of network security management (NSM) processes and services of a typical ITCN implemented in the NSC, as well as technologies that support the implementation of processes and the provision of services, supplemented by consideration of the general organization of the NSC functioning and its staffing. The NSC maturity model refers to a structured set of elements that combines the information need to establish the NSC maturity level with their attributes – NSC properties or characteristics. The requirements for UMM being developed for the organization's internal NSC are formulated, and their implementation is demonstrated at the end of the article. A formalized representation of the maturity model of NSC as an object for assessing the maturity level in five assessment areas, namely, the organizational support for the NSC functioning, the NSM processes for ITCN and the NSC as its integral part, the ITCN NSM services provided by the NSC, the technologies used and staffing, is introduced. A method for visualizing the obtained assessment results as pie charts is proposed. An approach to establishing the final NSC maturity level is presented. It is shown that all the formulated requirements for the NSC maturity model are met in the developed ITCN NSC UMM. Further, a methodology for the ITCN NSC UMM application should be created.