The Modeling of Processes of Design of Information Protection Systems in Critical Information Infrastructures

The relevance and necessity of implementations of measures of information security in CII (critical information infrastructures) is explained by several reasons. Firstly, these are the requirements of Russian legislation. Note that some CII objects, because of the nature of the information being processed, can also be attributed to GIS (state information systems) or ISPDn (personal data information systems). There are also requirements for information security measures [4; 5] for systems of this type, which largely correlate with the measures described for CII objects in [6]. Secondly, it is the objective presence of threats of various kinds that require neutralization and exist in almost all modern information systems. In order to ensure information security, the protective mechanisms used at CII facilities should take into account such factors as a significant amount of processed information, the need to ensure correct, stable and trouble-free operation, the multi-user nature of access to information resources, and ensuring the security of managed equipment. The fact that failures and errors in the operation of information systems in a number of CII of industrial enterprises can entail not only economic damage or negative social consequences, but also create a direct threat to the lives of a significant number of people, that live not so far to the place of work of these objects [11]. Modeling of the work performed at the design stage of information security systems of CII facilities is due to the complexity of this process. In present, ensuring the information security of CII facilities is one of the most important tasks currently being solved at the state level. These circumstances determine the relevance of writing the article. The purpose of writing this work is the developing of the set of models describing the features of organizational, legal and technical processes that arise at the stages of formation of requirements for ensuring information security of CII facilities. The normative legal acts of the FSTEC of Russia, which are in the public domain, are used as the methodological basis for writing the work. The methodology of functional graphical modeling IDEF0 was used to describe the ongoing work performed at the design stage of the information security system of the CII. The result of the research presented in this paper is a set of graphical and symbolic models describing the processes performed at the design stage of the information security system in critical information infrastructures.

modeling of information security processes, information security, information security management, graphical modeling, methodology of functional graphical modeling, critical information systems