Opportunity Makes the Thief. A Risk Analysis and Vulnerability Identification Approach in Information Security Management Systems as a Method of Countering Cybercrimes

Data processing in ICT systems is a fundamental activity in the information society. The aim of this article is to present tools specific to information security management systems, such as risk and vulnerability analysis as solutions that can contribute to reducing the incidence of cybercrimes. Limiting the occurrence of such incidents can therefore be considered as a proactive method of preventing the presence of such criminal acts. Considerations include legal instruments such as the GDPR and the NIS2 Directive, which provide for breach and incident management procedures, as well as a risk-based approach. An analysis of vulnerabilities, together with mechanisms for their reporting and the exchange of such information between authorized entities, is proposed in the new NIS2 Directive. It is an essential tool for increasing the resilience of ICT systems by securing their weakest links. Technical standards from the information security area ISO 27000 are also covered in this article. The interdisciplinary nature of the subject matter analyzed implies a discussion of such methods of increasing the effectiveness of security in ICT systems as penetration testing and hardening.