MODELING OF SECURITY THREATS FOR BUILDING A COMPREHENSIVE INFORMATION PROTECTION SYSTEM AT OBJECT OF INFORMATIZATION

Within the framework of this study, the typical structure of the informatization facility was analyzed in detail, which allowed qualified specialists to better understand the mechanisms and aspects through which various categories of objects and subjects of information processing that may be subject to security threats. The main mechanism for building a comprehensive information security system is the threat model. This model is aimed at identifying and identifying potential threats, their subsequent analysis and minimizing the risks of their implementation associated with damage to the informatization facility. In the framework of this study, the domestic FSTEC knowledge base and the international ATT&CK and CAPEC knowledge bases are considered to build a threat model. They contain comprehensive information about the tactics and techniques used by intruders in carrying out attacks on informatization facilities. In the course of the research, various tactics used by the attackers were classified in detail. Special attention was paid to the definition of the main tactics that determine the entry points of the informatization object, which are used to further carry out the attack. In the context of developing an effective threat model, it seems advisable to conduct a comprehensive analysis of the data contained in knowledge bases and their subsequent joint use in the process of building a threat model at informatization facilities. This approach makes it possible to systematize and structure information, which contributes to a more accurate and reasonable construction of a model for the implementation of potential threats at different stages of an attack on an informatization facility. To build a comprehensive information security system, a decision support system was considered. The analysis of modern scientific research devoted to the applied methods in the construction of support systems is carried out. As a result of the work, the relationship between knowledge bases of tactics and techniques, as well as well-known vulnerabilities, was shown using the ontology method, which allows us to build a model of a complex threat attack, and identify the targets affected by an attacker at various stages of a complex attack, the criticality of the vulnerability used and the platform on which this vulnerability is implemented, and the definition of negative consequences