Multidimensional classification matrix for information security risk assessment

In this study, we address one of the key challenges related to a comprehensive risk assessment system for information security concerning personnel during access delineation to company information resources. The relevance of this research is confirmed by numerous instances of information leaks, which highlight the insufficient effectiveness of traditional classification and access control methods. The research aims to analyze existing classification strategies for company information resources and develop an additional method based on continuous access analysis and dynamic adjustment of resource classification. To achieve this goal, we employed methods such as analyzing current information classification strategies, combining various classification techniques, and implementing a graphical method that combines traditional resource classification with a dynamic component using a multidimensional matrix. The main results of the study involve the development of an enhanced method that allows continuous analysis of personnel access to company information resources and dynamic adjustments to resource classification based on access delineation rules. The proposed approach allows for the inclusion of any number of indicators in a graph as a set of vectors, subsequently calculating overall risk assessments based on the sum or difference of these vectors. The practical value of this work lies in its ability to fully utilize modern access control technologies and serve as a foundation for further research, such as automated information classification using neural network training. Additionally, within this study, we conducted a detailed review of existing risk assessment methods for company information resources, identifying key limitations inherent in traditional approaches. Specifically, we analyzed methods based on fixed access levels and the use of static rules for access control. It became evident that such methods are inadequate in responding to dynamic changes in user behavior and the evolving importance of information resources. Thus, the proposed approach allows for more flexible and adaptive access control to information resources, achieved through continuous access monitoring and automatic adjustments based on behavioral user data and contextual changes in resource utilization.