Methodology for Assessing the Risks of Information Enterprise Security Using Case Technologies
Purpose of the study. Creating an effective information security system of an enterprise is impossible without an adequate assessment of the risks to which its assets are exposed. The results of such an assessment should become the basis for making decisions in the field of information security of t...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Plekhanov Russian University of Economics
2021-11-01
|
| Series: | Открытое образование (Москва) |
| Subjects: | |
| Online Access: | https://openedu.rea.ru/jour/article/view/830 |
| _version_ | 1826562819221356544 |
|---|---|
| author | А. V. Gavrilov V. A. Sizov E. V. Yaroshenko |
| author_facet | А. V. Gavrilov V. A. Sizov E. V. Yaroshenko |
| author_sort | А. V. Gavrilov |
| collection | DOAJ |
| description | Purpose of the study. Creating an effective information security system of an enterprise is impossible without an adequate assessment of the risks to which its assets are exposed. The results of such an assessment should become the basis for making decisions in the field of information security of the enterprise. Identification of information assets and assessment of their value, determination of the level of threats to the security of assets allow planning measures to create an enterprise information security system.This paper discusses a methodology for assessing the risks of information security of an enterprise, a distinctive feature and novelty of which is the use of modern tools and methods for constructing and analyzing business processes in order to identify the information assets of an enterprise to be protected.Materials and methods. It is proposed to identify information assets based on the model of business processes of the enterprise, performed using the IDEF0 methodology. Modeling of business processes was carried out in the Business Studio environment of the “Modern Management Technologies” company.The activity of a typical IT-industry company was considered as an example for the risk analysis.Results. The methodology for assessing the risks of information security of an enterprise described in the article has been successfully tested in the educational process. Its use in conducting laboratory classes in the discipline “Designing the information security system of enterprises and organizations” for masters studying in the direction of “Information security” allowed, according to the authors of the article, to increase the effectiveness of the formation of students’ professional competencies.Conclusion. The paper proposes a methodology for assessing information security risks for objects of an enterprise’s information infrastructure, which makes it possible to identify priority areas of information security at an enterprise. As a result of the application of the technique, a loss matrix is formed, showing the problem areas in the organization of information protection, which should be given priority attention when planning information security measures. Based on the data obtained, it is possible to form an economically justified strategy and tactics for the development of an enterprise information security system. |
| first_indexed | 2024-04-10T01:49:09Z |
| format | Article |
| id | doaj.art-b926848a81eb478d9a7ac6d08d3ac7eb |
| institution | Directory Open Access Journal |
| issn | 1818-4243 2079-5939 |
| language | English |
| last_indexed | 2025-03-14T09:54:07Z |
| publishDate | 2021-11-01 |
| publisher | Plekhanov Russian University of Economics |
| record_format | Article |
| series | Открытое образование (Москва) |
| spelling | doaj.art-b926848a81eb478d9a7ac6d08d3ac7eb2025-03-02T11:23:52ZengPlekhanov Russian University of EconomicsОткрытое образование (Москва)1818-42432079-59392021-11-01255414910.21686/1818-4243-2021-5-41-49582Methodology for Assessing the Risks of Information Enterprise Security Using Case TechnologiesА. V. Gavrilov0V. A. Sizov1E. V. Yaroshenko2Plekhanov Russian University of EconomicsPlekhanov Russian University of EconomicsPlekhanov Russian University of EconomicsPurpose of the study. Creating an effective information security system of an enterprise is impossible without an adequate assessment of the risks to which its assets are exposed. The results of such an assessment should become the basis for making decisions in the field of information security of the enterprise. Identification of information assets and assessment of their value, determination of the level of threats to the security of assets allow planning measures to create an enterprise information security system.This paper discusses a methodology for assessing the risks of information security of an enterprise, a distinctive feature and novelty of which is the use of modern tools and methods for constructing and analyzing business processes in order to identify the information assets of an enterprise to be protected.Materials and methods. It is proposed to identify information assets based on the model of business processes of the enterprise, performed using the IDEF0 methodology. Modeling of business processes was carried out in the Business Studio environment of the “Modern Management Technologies” company.The activity of a typical IT-industry company was considered as an example for the risk analysis.Results. The methodology for assessing the risks of information security of an enterprise described in the article has been successfully tested in the educational process. Its use in conducting laboratory classes in the discipline “Designing the information security system of enterprises and organizations” for masters studying in the direction of “Information security” allowed, according to the authors of the article, to increase the effectiveness of the formation of students’ professional competencies.Conclusion. The paper proposes a methodology for assessing information security risks for objects of an enterprise’s information infrastructure, which makes it possible to identify priority areas of information security at an enterprise. As a result of the application of the technique, a loss matrix is formed, showing the problem areas in the organization of information protection, which should be given priority attention when planning information security measures. Based on the data obtained, it is possible to form an economically justified strategy and tactics for the development of an enterprise information security system.https://openedu.rea.ru/jour/article/view/830information securityriskscase technologiesbusiness processidef0. |
| spellingShingle | А. V. Gavrilov V. A. Sizov E. V. Yaroshenko Methodology for Assessing the Risks of Information Enterprise Security Using Case Technologies Открытое образование (Москва) information security risks case technologies business process idef0. |
| title | Methodology for Assessing the Risks of Information Enterprise Security Using Case Technologies |
| title_full | Methodology for Assessing the Risks of Information Enterprise Security Using Case Technologies |
| title_fullStr | Methodology for Assessing the Risks of Information Enterprise Security Using Case Technologies |
| title_full_unstemmed | Methodology for Assessing the Risks of Information Enterprise Security Using Case Technologies |
| title_short | Methodology for Assessing the Risks of Information Enterprise Security Using Case Technologies |
| title_sort | methodology for assessing the risks of information enterprise security using case technologies |
| topic | information security risks case technologies business process idef0. |
| url | https://openedu.rea.ru/jour/article/view/830 |
| work_keys_str_mv | AT avgavrilov methodologyforassessingtherisksofinformationenterprisesecurityusingcasetechnologies AT vasizov methodologyforassessingtherisksofinformationenterprisesecurityusingcasetechnologies AT evyaroshenko methodologyforassessingtherisksofinformationenterprisesecurityusingcasetechnologies |