DSpace Home
→
Електронні публікації
→
Фізико-математичний факультет
→
Кафедра інформатики та прикладної математики
→
View Item

Method of Assessing the Influence of Personnel Competence on Institutional Information Security

Pilkevych, Ihor; Boychenko, Oleg; Lobanchykova, Nadiia; Vakaliuk, Tetiana; Семеріков, Сергій Олексійович; Вакалюк, Тетяна Анатоліївна

URI: http://ceur-ws.org/Vol-2853/paper33.pdf
http://elibrary.kdpu.edu.ua/xmlui/handle/123456789/4374
https://doi.org/10.31812/123456789/4374

Date: 2021-04-23

Abstract:

Modern types of internal threats and methods of counteracting these threats are analyzed. It is established that increasing the competence of the staff of the institution through training (education) is the most effective method of counteracting internal threats to information. A method for assessing the influence of personnel competence on institutional information security is proposed. This method takes into account violator models and information threat models that are designed for a specific institution. The method proposes to assess the competence of the staff of the institution by three components: the level of knowledge, skills, and character traits (personal qualities). It is proposed to assess the level of knowledge based on the results of test tasks of different levels of complexity. Not only the number of correct answers is taken into account, but also the complexity of test tasks. It is proposed to assess the assessment of the level of skills as the ratio of the number of correctly performed practical tasks to the total number of practical tasks. It is assumed that the number of practical tasks, their complexity is determined for each institution by the direction of activity. It is proposed to use a list of character traits for each position to assess the character traits (personal qualities) that a person must have to effectively perform the tasks assigned to him. This list should be developed in each institution. It is proposed to establish a quantitative assessment of the state of information security, defining it as restoring the amount of probability of occurrence of a threat from the relevant employee to the product of the general threat and employees of the institution. An experiment was conducted, the results of which form a particular institution show different values of the level of information security of the institution for different values of the competence of the staff of the institution. It is shown that with the increase of the level of competence of the staff of the institution the state of information security in the institution increases.

Description:

[1] 2020 Insider Threat Report. Cybersecurity Insiders, URL: https://www.cybersecurityinsiders.com/wp-content/uploads/2019/11/2020-Insider-Threat-Report-Gurucul.pdf [2] N. Kuharska, Informacijna bezpeka jak element korporatyvnoji struktury Aktualʹni problemy upravlinnja informacijnoju bezpekoju deržavy: zb. tez nauk. dop. nauk.-prakt. konf. (Kyjiv, 4 kvitnja 2019. Kyjiv : Nac. akad. SBU) 70–73. [3] A. A. Cain, M. E. Edwards, J. D. Still, An exploratory study of cyber hygiene behaviors and knowledge. Journal of Information Security and Applications. Vol. 42 (2018) 36-45. [4] S.Honchar, H. Leonenko, Analysis of the factors influencing condition cybersecurity of information system of object of the critical infrastructure. Information Technology and Security. Vol. 4, Iss. 2 (7) (2016) 262-268. [5] S. Kovalenko. Insajderska zahroza jak odna z aktualnyx problem kiberbezpeky. Osnovni metody vyjavlennja Aktualʹni problemy kiberbezpeky : zb. tez dop. Vseukrajinsʹkoji nauk. konf. (Kyjiv, 24 žovtnja 2019 Kyjiv : DUT) 28–32. [6] J. Eggenschwiler, I. Agrafiotis, J. RC Nurse, Insider threat response and recovery strategies in financial services firms. Computer Fraud & Security. Vol. 2016, Iss. 11 (2016) 12-19. [7] W. F. Gross, Insider Threat. Computer and Information Security Handbook. (2017) 529-536. [8] Faisal Janjua, Asif Masood, Haider Abbas, Imran Rashid, Handling Insider Threat Through Supervised Machine Learning Technique. Vol. 177 (2020) 64-71. [9] Shuhan Yuan, Xintao Wu, Deep Learning for Insider Threat Detection: Review, Challenges and Opportunities. Computers & Security (2021) 102221. [10] Z. A. Soomro, M. H. Shah, J. Ahmed, Information security management needs more holistic approach: A literature review. Vol. 36, Iss. 2 (2016) 215-225. [11] J. Funke, A. Fischer & D. V. Holt, Competencies for complexity: problem solving in the twenty-first century. In Assessment and teaching of 21st century skills, pp. 41-53. Springer, Cham (2018). [12] A. Parrish, J. Impagliazzo, R. K. Raj, H. Santos, M. R. Asghar, A. Jøsang, T. Pereira, E. Stavrou, Global perspectives on cybersecurity education for 2030: a case for a meta-discipline. In Proceedings Companion of the 23rd Annual ACM Conference on Innovation and Technology in Computer Science Education (ITiCSE 2018 Companion). Association for Computing Machinery, New York, NY, USA, (2018) 36–54. doi: https://doi.org/10.1145/3293881.3295778. [13] E. Kashtanova, A. Lobacheva, S. Makushkin, T. Ridho, A Competency Model in the Field of Information Technology. In: Bogoviz A.V., Suglobov A.E., Maloletko A.N., Kaurova O.V., Lobova S.V. (eds) Frontier Information Technology and Systems Research in Cooperative Economics. Studies in Systems, Decision and Control, vol 316. Springer, Cham (2021) https://doi.org/10.1007/978-3-030-57831-2_58. [14] S. Shevchenko, Yu. Zhdanova, Mathematical competencies of future specialists information security. Suchasniy zahist informatsii. 4 (2016) 90-96. [15] O. Mandzuk, Qualification requirements to the competence of information analytics-lawyers. Scientific notes of Taurida National V. Vernadsky University. Juridical Sciences. 26(68) (2018) 64-72. [16] V.Buryachok, I.Parhomey, M.Stepanov, V.Tolubko. Problemni pytannja ta aktualʹni zavdannja pidhotovky faxivciv z kibernetyčnoji bezpeky haluzi znanʹ «Informacijni texnolohiji». Suchasniy zahist informatsii. 2(2016) 4-9. [17] M. Bohlouli, N. Mittas, G. Kakarontzas, T. Theodosiou, L. Angelis, M. Fathi, Competence assessment as an expert system for human resource management: A mathematical approach. Expert Systems with Applications, vol. 70 (2017) 83-102. [18] V. Belevitin, S. Bogatenkov, V. Rudnev, M. Khasanova, A. Tyunin, Integrated approach to modeling IC Competence in students. International Journal of Engineering & Technology, 7(4) (2018) 60-62. [19] S. Lysenko, K. Bobrovnikova & O. Savenko, A botnet detection approach based on the clonal selection algorithm. In 2018 IEEE 9th International Conference on Dependable Systems, Services and Technologies (DESSERT). IEEE (2018) 424-428. [20] S. Lysenko, K. Bobrovnikova, S. Matiukh, I. Hurman & O. Savenko, Detection of the botnets' low-rate DDoS attacks based on self-similarity. International Journal of Electrical & Computer Engineering, 2020, 10, 2088-8708. [21] D. Magis, J. R. Barrada, Computerized adaptive testing with R: Recent updates of the package catR. Journal of Statistical Software, 76(1) (2017) 1-19. [22] G. Ling, Y. Attali, B. Finn, E. A. Stone, Is a Computerized Adaptive Test More Motivating Than a Fixed-Item Test? Applied Psychological Measurement, 41(7) (2017) 495–511. [23] E. D. Heggestad, D. J. Scheaf, G. C. Banks, M. Monroe Hausfeld, S. Tonidandel, E. B. Williams, Scale Adaptation in Organizational Science Research: A Review and Best-Practice Recommendations. Journal of Management, 45(6) (2019) 2596–2627. [24] Van der Linden, W. J. (Ed.), Handbook of item response theory, three volume set. CRC Press (2018). [25] O.Boychenko, R.Ziubina. The method of calculation of probability of realization of threats of information with the limited access from an internal user violator. Information systems and technologies security. 1 (2019) 19–26.

Show full item record