Modern types of internal threats and methods of counteracting these threats are analyzed. It is established that increasing the competence of the staff of the institution through training (education) is the most effective method of counteracting internal threats to information. A method for assessing the influence of personnel competence on institutional information security is proposed. This method takes into account violator models and information threat models that are designed for a specific institution. The method proposes to assess the competence of the staff of the institution by three components: the level of knowledge, skills, and character traits (personal qualities). It is proposed to assess the level of knowledge based on the results of test tasks of different levels of complexity. Not only the number of correct answers is taken into account, but also the complexity of test tasks. It is proposed to assess the assessment of the level of skills as the ratio of the number of correctly performed practical tasks to the total number of practical tasks. It is assumed that the number of practical tasks, their complexity is determined for each institution by the direction of activity. It is proposed to use a list of character traits for each position to assess the character traits (personal qualities) that a person must have to effectively perform the tasks assigned to him. This list should be developed in each institution. It is proposed to establish a quantitative assessment of the state of information security, defining it as restoring the amount of probability of occurrence of a threat from the relevant employee to the product of the general threat and employees of the institution. An experiment was conducted, the results of which form a particular institution show different values of the level of information security of the institution for different values of the competence of the staff of the institution. It is shown that with the increase of the level of competence of the staff of the institution the state of information security in the institution increases.

У статті проведено аналіз інфраструктури відкритих ключів Збройних Сил України та національної системи електронних довірчих послуг України. За результатами аналізу визначене актуальне науково-практичне завдання щодо розробки технології надання електронних довірчих послуг в інформаційно-комунікаційних системах Збройних Сил України, де обробляється інформація, що містить державну таємницю. Обґрунтовані додаткові вимоги до інфраструктури відкритих ключів ЗСУ щодо захисту інформації під час обміну секретними електронними документами користувачами інформаційно-комунікаційних систем ЗСУ різного рівня секретності. Розроблено типову структуру програмно-технічного комплексу системи обігу секретних електронних документів ЗСУ, в якій введені нові апаратно-програмні рішення для організації обміну секретними електронними документами між користувачам інформаційно-комунікаційних систем ЗСУ різного рівня секретності. Наведена інфраструктура відкритих ключів ЗСУ забезпечить роботу військовослужбовцям та працівникам ЗСУ, які мають сертифікат відкритого ключа, з будь-якого робочого місця в інформаційно-комунікаційних системах ЗСУ різного рівня секретності згідно з політикою безпеки інформації у відповідній інформаційно-комунікаційній системі ЗСУ.

The article is devoted to the solution of the actual scientific and practical task – to develop a mathematical model for assessing the risk of unauthorized access to information by users of the information and telecommunication system. Interpretations of such concepts are given: unauthorized access to information, risk and risk assessment used in the course of internal threat research. The characteristics of the user of the information and telecommunication system that affect the value of the probability of unauthorized access to information are determined. It is shown that taking into account the theoretical and practical knowledge of the user of the information and telecommunication system about the characteristics of the physical environment, the computing system, the processed information, which he can use to deliberately violate the rules of demarcation in order to gain unauthorized access to information, will provide a more accurate assessment of this risk. A verification of the adequacy of the developed mathematical model of risk assessment of unauthorized access to information by users of information and telecommunication system with the help of special software is carried out. It is established that the users who have the most experience and experience with information and telecommunication systems (not only in the institution under consideration), the highest level of access to information with restricted access of the institution (organization), occupy responsible positions and are undisciplined are the most likely internal threat of unauthorized access to information. It is the use of a mathematical model for assessing the risk of unauthorized access to information by users of the information and telecommunication system that will improve the comprehensive information protection system of the corresponding information and telecommunication system.

The paper proposes ways to optimize information support enforcement forces from improving the forms and methods of management information system. The main routes are centralization and integration of computer data banks and the introduction of new information technologies to conduct criminology, forensic accounting, the widespread use of efficient computer networks, the use of specialized information security, establishing effective exchange of criminological information at the international level.