This article examines the models and methods of protection of information security systems, in particular, the model of building a corporate information security system, the model of security analysis in the absence of intrusive threats in information systems and the three-tier model of information security systems. As a result of the analysis of corporate information protection systems, models and recommendations for improving the efficiency of the information protection system are proposed.

The security monitoring system (SMS) receives information from the means of protection, detecting attacks, systems for monitoring the functioning of information communication systems (ICS) and performs adaptive security management of ICS, providing a flexible response of the security system to the actions of the intruder. In this case, the result of the functioning of the SMB are recommendations for modifying the ICS security system, in accordance with the specified restrictions, in order to minimize the possible damage from the implementation of threats. A complex of security systems is used in modern ICS. Typically, different systems are not linked and are purchased from different manufacturers. Even when using protection systems from one manufacturer, it is quite difficult to understand the events taking place in the ICS. When assessing the effectiveness of SMB, methods of expert assessments are used, i.e. methods of organizing work with specialist experts and processing expert opinions expressed in quantitative and / or qualitative form in order to prepare information for the formation of internal characteristics of the ICS SMB. Based on the analysis of existing approaches to assessing the effectiveness of SMB in the work for conducting research on the parameters of SMB in the ICS, a method is proposed that allows to evaluate the efficiency of SMB functioning.