THE CONCEPT OF INFORMATION SECURITY MANAGEMENT BASED ON A CYCLE OF INFORMATION SECURITY INCIDENTS CONTINUOUS DETECTION AND RESPONSE

Abstract

For dynamically changing management objects, new tasks arise in the task of information security management, such as changing approaches to data collection and analysis, developing dynamic scenarios for responding to information security threats. They should be solved through the creation of algorithms, models, methods and approaches of security management applicable to this task, including at the level of organizing processes, working with data and forming the organization's information security architecture. In addition, for the development and formation of continuous detection and response tools, it is necessary to propose new ways of integrating these algorithms into the structure of the control object. At the same time, the creation of response systems based on the new concept also involves changing the security management algorithms of such systems in special cases, such as decentralized management, stability testing, cloud security services and others that require separate research. At the same time, responding to information security incidents should take into account the continuously changing threat landscape and reconfiguration of the organization's infrastructure. Also, the development of the new concept presented in the article was influenced by the concept of object-oriented programming in terms of the main provisions. This work contains a description of the control concept based on a continuous detection and response cycle, provides some algorithms and processes that distinguish the implementation of the concept shown, as well as examples of their implementation. The practical examples given in the article relate to issues such as the formation of the incident neighborhood, and allow you to form the context of information security management. In addition, an approach to automation of information security management processes is shown. The results of the work can be used both for simulation models and for implementation as a set of information security management processes in practical tasks. In addition, the results obtained can be integrated into orchestration tools for information security systems, which increases the effectiveness of responding to information security incidents.