Quantitative assessment of the probability of protective system functioning without unlawful actions

Information security, also known as InfoSec, is the practice of preventing unauthorized access, use, disclosure, disruption, modification, or destruction of information. The primary goal of information security is to achieve a balanced protection of data confidentiality, integrity, and availability, while considering the expediency of application and without any harm to the organization's productivity. In this paper, the security levels (threats) T of the k-th threat to the properties of information circulating in the information and telecommunications system (ITS) are obtained from the parameters: c – assessment of the impact of the k-th threat on the confidentiality of information, i, a and s – assessments of the impact of the k-th threat on the integrity, availability, and observations of information, respectively. The weight coefficient p determines the share of the occurrence of this threat relative to the entire set of threats and can be calculated based on the analysis of ITS operation statistics or using known forecasting methods. The probability of no unauthorized access to information during the operation of the protection system has been quantitatively assessed. The assessment is based on the parameters: a – the intensity of the protection system's suppression of attempts to illegally access information, b – the intensity of such attempts at the input to the protection system, t – the number of days of the system's operation. For graphical interpretation of the dependencies, graphical materials are presented. For this purpose, modeling was performed in the MatLab system. The graphical materials clearly indicate the possibility of obtaining a state of operation of the protection system without unauthorized actions depending on the influence of threats to confidentiality, integrity, availability of information, and unauthorized access to information depending on the parameters of the intensity of suppression by the protection system of attempts to illegally access information, and the intensity of such attempts at the input to the protection system. This will, unlike analogues, allow developers of information systems and service personnel to have quantitative indicators of the probability of no unauthorized access to information and to make decisions regarding possible vulnerabilities.