Search

Search Results

• INFORMATION SECURITY MANAGEMENT IN THE DIGITAL TRANSFORMATION PROCESS: MODELING BASED ON HETEROGENEOUS GRAPHS AND RISK METRICS

  К.V. Yakimenko , V.V. Zolotarev

  246-256

  2025-07-24

  Abstract ▼

  This study is devoted to the critical problem of ensuring information security of organizations in the context of active digital transformation, which inevitably entails an increase in attack surfaces, the emergence of new vulnerabilities and risks of destabilization of security systems. The authors propose a process-oriented approach based on modeling business processes (BP) and the IT landscape using heterogeneous graphs. This model represents three key types of entities: operations, information systems (IS), and data as objects of protection, as well as attributed edges reflecting transmission channels and their security characteristics. This approach ensures the complete identification of CII objects in accordance with the requirements of the FSTEC and allows the analysis of complex relationships in the transitional states of CT. The study developed a set of key quantitative metrics for information security risk management:
  1. Number of Critical Paths (CCPs): Reflects the change in the attack surface when adding/removing ICS and data routes. 2. Node Centrality Level (UCU): Defines the most critical for connectivity and vulnerable IP (risk concentration points). 3. Data Distribution Index (DDI): Characterizes the ratio of cloud and local data storage/processing nodes and the associated control and security risks. 4. Recovery Time (BB): Evaluates the stability of the PS to failures and attacks. 5. The level of Automation of Protection (UAZ): Shows the proportion of automated information security tasks for rapid response. Based on the model and metrics, a dynamic algorithm for managing the information security of the CT process is proposed. The algorithm provides: 1. Construction of graph models of BP "as it is" and "as it should be". 2. Continuous dynamic updating of the current state model during the CT. 3. Regular calculation of metrics for risk assessment in transition states. 4. Updating the list of risks and protective measures based on the analysis of metrics. The results include practical recommendations on: reducing the attack surface; prioritizing node protection with a high level of criticality; optimizing data distribution taking into account security and fault tolerance requirements. The proposed approach ensures transparency and manageability of information security at all stages of the IT process, increases the resilience of the IT landscape to threats and compliance with regulatory requirements.

• CLASSIFICATION OF PROCESSING NODES IN BIG DATA SYSTEMS ACCORDING TO THE ZERO TRUST APPROACH

  М.А. Poltavtseva , D. V. Ivanov

  55-62

  2025-07-24

  Abstract ▼

  Data cybersecurity is one of the most important factors for the successful implementation of the national project ‘Data Economy and Digital Transformation of the State’. The challenges of building secure big data systems lie in their heterogeneous nature, large number of heterogeneous tools, high connectivity and high trust between distributed components. Reducing the internal trust and reducing the attack surface according to the zero-trust approach is necessary to increase the security of such systems with the least impact on their performance. The aim of the paper is to create a method for dynamic classification of nodes and data processing components in heterogeneous big data systems based on the application of different approaches to trust reduction with respect to the objects realising the information processing process. The paper considers the zero trust approach as applied to the class of systems under study, as well as the task of extended implementation of the principle of minimum privilege to reduce the attack surface. The authors present a classification of nodes - handlers based on their operations with data, unified according to the previously developed conceptual data model. A comparison of nodes and security methods applied to them based on the need for access to semantics and data components to perform operations is proposed. Based on this classification, a method of dynamic node type determination during system operation is developed for situations of changing component composition of a big data processing system, typical for multi-component distributed highly loaded systems. The results of the work are a part of the complex consistency approach to the construction of secure big data processing systems.