Information security risk management device in information systems

The paper proposes a device for managing information security risks in information systems. The proposed device contains an asset identification module, a threat identification module, a vulnerability identification module, an information security risk processing module, and an information security risk analysis report design module. The first output of the asset identification module is connected to the input of the threat identification module, and the second output is connected to the input of the vulnerability identification module, which are interconnected by feedback. The technical result is to increase the speed of information security level analysis, increase the efficiency of the information security risk assessment algorithm, reduce the amount of reporting material generated by the device during operation, create an additional opportunity to create information security level report templates and modify existing ones, create an additional opportunity to avoid risk, or acceptance of information security risk by additional introduction to the information security risk management device in information systems of the module for determining the probability of the realization of threats, the module for assessing the possible consequences of the implementation of threats, the module for determining the level of information security risk, the module for determining the permissible level of information security risk