FORMS, METHODS AND MEANS OF DETECTING, ASSESSING AND PREDICTING THREATS TO INFORMATION SECURITY IN UKRAINE

Timely detection and processing of information security events and incidents (hereinafter – IS) is one of the most important tasks of ensuring information security in modern conditions. In connection with the intensification of information warfare and military aggression, organizations face new IS threats that are becoming increasingly complex and sophisticated. In such conditions, timely detection of IS incidents is critically important to minimize their negative consequences. The article discloses the algorithm of measures and methodical approaches regarding the sequence of processing information security events and incidents, which includes the technical restoration of information systems and contains the procedure for the personnel to restore critical IT services, understanding the issues of regulations of the information security incident management system. Methods of responding to IS events and incidents are analyzed. One of the most common ways is to use IS monitoring systems that collect and analyze data about IS events and incidents that occur in the organization. Based on this data, IS monitoring systems can automatically or manually detect IS incidents and take appropriate measures. Another way to respond to IS events and incidents is through the use of IS Incident Response Teams (CIRTs). The CIRT is a group of professionals who specialize in detecting and responding to IS incidents. CIRTs can be internal (composed of the organization's employees) or external (composed of professionals providing IS incident response services). The stages of processing IS events and incidents are considered: Detection: detection of IS events and incidents. This step can be automated or manual. Assessment: assessment of identified IS events and incidents in order to determine their nature and severity. Response: implementation of measures to eliminate identified IS events and incidents. Research: conducting a research of identified IS events and incidents in order to determine their causes and consequences. Practical recommendations are provided for improving the processes of identifying and processing IS events and incidents, supporting the effective functioning of IS event monitoring systems, in particular, the following measures: – ensuring the proper organization of the IS incident management process, which involves the development and implementation of IS incident management policies and procedures, as well as the training of personnel who will be responsible for identifying and responding to IS incidents; – implementation of IS monitoring systems capable of detecting a wide range of IS events and incidents, as well as ensuring effective processing of detected IS events and incidents; – creation of an effective algorithm for responding to IS incidents, which will determine the order of actions that must be performed to eliminate detected IS events and incidents; – conducting regular exercises and trainings on identifying and responding to IS incidents, which will help staff acquire the necessary knowledge and skills to effectively identify and respond to IS incidents. Key words: threat source, IS events and incidents, IS incident response process, event monitoring system, IS incident management system, event processing and correlation systems.