Methods of Component IT-Security Risk Assessment for IT Critical Infrastructure Entities

When quantifying the security risks of IT critical infrastructure entity components, the well-known requirements of functional security standards are followed. Unlike many regulatory and industry requirements, functional security standards are based on quantitative risk assessments. This publication shows examples of computing the cumulative security level of IT critical infrastructure entities, subject to the implementation of current standards of risk components quantifying. Examples of “direct” estimation are presented - the cumulative risk level of IT critical infrastructure entities is evaluated by available estimates of components (controllers) and “reverse” one - when the minimum acceptable risk level of all components within a particular IT critical infrastructure entity is evaluated by known customer requirements. The obtained results can be used in the security estimates of IT critical infrastructure entities.