Conceptual foundations for assessing the level of security of automated systems based on their vulnerability

Objective. The purpose of the article is to analyze existing methods and procedures used to assess the level of software security of automated systems, based on a study of scientific literature, international and industry standards of the Russian Federation on information security of automated systems, guidelines and methodological documents of the Federal Service for Technical and Export Control Russia, as well as departmental orders on the protection of information from unauthorized access at informatization facilities of internal affairs bodies. Method. To achieve this goal, the method of system analysis of approaches used in assessing the level of software security in automated systems was used. Result. The results of an analysis of the main approaches to assessing the level of software security in automated systems are presented. The expediency of combining the considered approaches to carry out a quantitative assessment of the level of software security at informatization facilities of internal affairs bodies in real time, taking into account vulnerabilities in the software used, is substantiated. Conclusion. The results obtained can be used to generate indicators of the level of software security in automated systems of internal affairs bodies and to develop methods for their calculation taking into account the time factor.

Methods for assessing the level of security of software of automated systems of internal affairs bodies and directions for their improvement

Drovnikova,

Popova

2024

Characterization of security defects and analysis of vulnerability criticality in software for automated systems of internal affairs bodies

Drovnikova,

Popova

2024

Objective. The purpose of the study is to theoretically analyze security defects and study the criticality of vulnerabilities in software used in modern automated systems of internal affairs agencies.Method. A systematic approach method was used to consider the essence of the problem of assessing the security of software of automated systems of internal affairs bodies and the criticality of its vulnerabilities.Result. The results of an analysis of theoretical aspects of the study of vulnerabilities in software of automated systems are presented. The components of typical software used in the automated workstation of a user of a modern automated system of internal affairs bodies were analyzed for the presence of known vulnerabilities presented in the US National Vulnerability Database and the Data Bank of Information Security Threats of the Federal Service for Technical and Export Control of Russia, obtaining basic estimates for standard Common Vulnerability Scoring System versions 3.0 and 3.1.Conclusion. Carry out timely updates of the software used based on the selection of its optimal version in terms of security level. The main directions of activity for conducting a quantitative assessment of the level of software security in automated systems of internal affairs bodies are outlined, taking into account its vulnerabilities in real time.

Algorithm for the functioning of the analysis and evaluation software package security of software of automated systems internal affairs bodies

Popova

2024

Objective. The purpose of the study is to construct an algorithm for the functioning of a software package that automates the process of analyzing and assessing the security of the software used and selecting its most secure version for use at informatization facilities of internal affairs bodies.Method. During the study, we used: a method of a systematic approach to determining software security indicators, a method of mathematical formalization and algorithmization of the process of analyzing and assessing software security for developing program code.Result. An algorithm for the functioning of a software complex is proposed that allows for analysis and quantitative assessment of the security of software of automated systems of internal affairs bodies in relation to current vulnerabilities in real time. The algorithm is complex in nature, including five component algorithms. The operation of the main blocks of the algorithm is described.Conclusion. Conclusions are drawn about the importance of the practical implementation of the developed algorithm in the form of a software package that selects the optimal (most secure) version of software for operation at informatization facilities of internal affairs bodies in order to increase the actual security of limited-distribution official information.