Персона: Милославская, Наталья Георгиевна
Email Address
Birth Date
Результаты поиска
РАСШИРЕННАЯ МОДЕЛЬ ЗРЕЛОСТИ SOC КОМПАНИИ CYBEREASON
Предлагаемая расширенная модель зрелости центра мониторинга безопасности (Security Operations Center – SOC), разработанная на основе модели компании Cybereason, формирует системный подход к оценке уровня зрелости и совершенствованию SOC за счет эволюционного перехода от более низкого уровня к более высокому. Целью данного исследования является расширение модели зрелости SOC компании Cybereason за счет формулирования дополняющих ее основных критериев, характеризующих эффективность SOC, включая показатели среднего времени обнаружения инцидентов информационной безопасности (ИБ) MTTD, среднего времени реагирования ни инциденты ИБ MTTR и процента ложноположительных срабатываний FPR, а также степени автоматизации АС основных процессов SOC. При оценке уровня зрелости SOC необходимо также учитывать комплексный подход к применению в центре передовых технологических решений (SIEM-, SOAR-, XDR-, UEBA-систем), международных стандартов (NIST CSF 2.0, ISO/IEC 27001), принципов долговременного хранения данных, а также общепризнанных подходов (MITRE ATT&CK, Threat Intelligence), искусственного интеллекта, машинного обучения и больших языковых моделей (LLM). Результаты исследования демонстрируют, как внедрение унифицированных подходов к обработке инцидентов ИБ, автоматизация рутинных задач, выполняемых в SOC, и организация единого озера данных повышают качество аналитики и сокращают время отклика на компьютерные атаки. Предлагаемая в статье расширенная модель зрелости SOC применима в различных секторах деятельности, где важна киберустойчивость, и служит инструментом для планирования развития SOC с учётом динамики угроз ИБ. Выводы указывают на необходимость комплексного внедрения технологических и организационных мер, позволяющих переходить к более высоким уровням зрелости SOC и обеспечивать эффективную кибербезопасность активов организаций.
Designing Competency Models for Cybersecurity Professionals for the Banking Sector
© 2020, IFIP International Federation for Information Processing.The research results for the main stages of designing competency models (CMs) for cybersecurity (CS) professionals are presented. A strategy for designing such models was formulated. The CS-related terminology and conceptual framework were clarified. Areas, objects, and types of professional activity (PA) as a whole for CS professionals and the banking sector, in particular, were determined. It is proposed to use the role and process models to determine the tasks that employees of banking organizations should solve. The practical issues of developing CMs, which allowed to determine the order of their development and the typical structure, as well as to formulate recommendations on the content of a specific CM, are considered.
Maturity Concept and Model Review
© 2022, The Author(s), under exclusive license to Springer Nature Switzerland AG.The management principle is widely known, according to which an activity cannot be managed if it cannot be measured and evaluated for compliance with the established requirements and assessment criteria. In turn, processes cannot be managed if they are not defined, and processes cannot be improved if they are not controlled. These ideas are fully applicable to the information security management processes. The goal of the paper is to introduce the concept of a maturity model, based on a generalization of numerous sources, and to provide a short review of such models. In conclusion, the maturity models for developing a maturity model for network security centers with network security management processes to be assessed are identified for the future work.
Cyber Polygon Site Project in the Framework of the MEPhI Network Security Intelligence Center
© 2021, The Author(s), under exclusive license to Springer Nature Switzerland AG.At present, the market for information protection tools (IPTs) is much wider than a couple of years ago. But not only technology protects and carries a threat. People are still at the forefront as the most common cause of errors is the lack of experience and low competency. The only right solution is the creation of cyber polygons as specially equipped and controlled network infrastructures for developing practical skills to combat information security (IS) threats. The National Research Nuclear University MEPhI (Moscow Engineering Physics Institute) could not remain aloof from this process as the leading institute for IS training in Russia. Therefore, it was decided to create such a cyber polygon within the framework of the educational and research Network Security Intelligence Center (NSIC) for intelligent network security management established at the MEPhI Institute of Cyber Intelligence Systems in 2016. The paper describes the first results achieved in making this project a reality. It introduces the “Cyber Polygon” term, briefly analyzes a state of the current cyber polygons development worldwide, and introduces the MEPhI Cyber Polygon objectives and provision to be used within the framework of the “Business Continuity and Information Security Maintenance” Master’s degree programme. Further activities in its development conclude the paper.
ВОПРОСЫ ПОИСКА ИНФОРМАЦИИ ОБ ОРГАНИЗАЦИЯХ ПО ОТКРЫТЫМ ИСТОЧНИКАМ
Рассматриваются вопросы поиска новых подходов к обеспечения информационной безопасности (ИБ) функционирования организаций в условиях цифровой трансформации, способных минимизировать угрозы несанкционированного доступа (НСД) к ресурсам организации, представляющим коммерческую тайну.
On the assessment of compliance with the requirements of regulatory documents to ensure information security
© The Editor(s) (if applicable) and The Author(s), under exclusive license to Springer Nature Switzerland AG 2020.Examples of different types of assessments are all around us, providing our assurance that the goods we use won’t harm us, that the system components will work correctly, that services are being delivered consistently, that manufacturers are effectively managing the impact of their activities on health, safety, and the environment, etc. One of the essential forms of assessment is a compliance assessment designed to check how the requirements of regulatory documents to ensure information security (IS) are fulfilled or not on the assessment object, for example, a product, process, system, or service. This short paper discusses work-in-progress results as a part of research aimed at determining the ways of possible improvement, unification and greater formalization of an objective assessment of compliance with the mandatory requirements of regulatory documents on ensuring IS for the selected assessment objects based on the development of recommendations for applying a risk-based approach.
Applying graph theory to detect cases of money laundering and terrorism financing
© 2020, IGI Global.A technique to automate the generation of criminal cases for money laundering and financing of terrorism (ML/FT) based on typologies is proposed. That will help an automated system from making a decision about the exact coincidence when comparing the case objects and their links with those in the typologies. Several types of subgraph changes (mutations) are examined. The main goal to apply these mutations is to consider other possible ML/FT variants that do not correspond explicitly to the typologies but have a similar scenario. Visualization methods like the graph theory are used to order perception of data and to reduce its volumes. This work also uses the foundations of information and financial security. The research demonstrates possibilities of applying the graph theory and big data tools in investigating information security incidents. A program has been written to verify the technique proposed. It was tested on case graphs built on the typologies under consideration.