MODIFICATION OF THE MODEL FOR CALCULATING THE LEVEL OF CYBER SECURITY OF CRITICAL INFRASTRUCTURE FACILITIES

Abstract

The growing intensity of cyber threats and cyber attacks, especially from the Russian Federation, poses an unprecedented danger to critical infrastructure and critical information infrastructure. The consequences of such incidents can be catastrophic, causing massive economic damage, social destabilization, and a direct threat to life. This increase in the number of cyberattacks requires continuous improvement of approaches to cybersecurity and an objective assessment of their level of protection. In view of this need, a model for calculating the level of cyber protection was developed. During the testing of the model, certain shortcomings were identified, in particular the inadequacy of the criteria systems and the ambiguity of the integral indicator, which limited its relevance and accuracy, especially in the context of dynamic changes in Ukrainian legislation. This led to the modification of the model by expanding the number of criteria systems and their indicators in accordance with current national regulations and the specific characteristics of each critical infrastructure sector. The key change is the expansion of the set of criteria for assessing cyber protection. A new, seventh system of criteria, “Sectoral Component” has been added to the six mandatory groups of measures (Government, Identification, Protection, Detection, Response, Recovery). This system allows for the integration of industry (sectoral) characteristics of different critical infrastructure sectors. The modified model has a hierarchical structure and presents the result in the form of a single integrated quantitative indicator, interpreted on a five-level percentage scale, consistent with international maturity models, enabling an objective assessment of the maturity level of cyber protection for critical information infrastructure facilities and the development of targeted strategies to improve it.