Mikov

The main information security risk management principles and their practical application features in the enterprise are overviewed. The basic criteria description for the information security risk management and the necessary data set for criteria determining are given. Required information system components and elements for the information security risk analysis and their identification peculiarities in the organization are defined. A methodology algorithm version for quantitative and qualitative information security risk assessment by the expert survey using is presented. Risk treatment methods and their application terms in different situations are described.

A modeling problem of information risks in computer-aided systems was considered in this paper. It was shown that a usage of fuzzy models is a promising approach to solving this problem because their development requires far less information about the system. Analysis of various types of fuzzy models was carried out; their main features were emphasized. The Mamdani model was recognized as the most suitable for estimating information risks. Combination of fuzzy and neural network modeling was proposed; that means the creation of neuro-fuzzy networks by transforming the Mamdani fuzzy model to a self-learning neural network, which operates on the basis of fuzzy logical apparatus and fuzzy sets. An example of a neuro-fuzzy network for an assessment of information risks was presented.