ERP-SYSTEM RISK ASSESSMENT METHODS AND MODELS

Authors

  • A. D. Kozhukhivskyi State University of Telecommunications, Kyiv, Ukraine
  • O. A. Kozhukhivska State University of Telecommunications, Kyiv, Ukraine

DOI:

https://doi.org/10.15588/1607-3274-2020-4-15

Keywords:

Information security, fuzzy logic, risk assessment, security, ERB-system.

Abstract

Context. Because assessing information security risks is a complex and complete uncertainty process, and non-appearance is a major factor influencing the effectiveness of the assessment, is advisable use vague methods and models that are adaptive to noncomputed data. The formation of vague assessments of risk factors is subjective, and risk assessment depends on the practical results obtained in the process of processing the risks of threats that have already arisen during the functioning of the organization and experience of information security professionals.

Objective. The object of the study are neural models that combine methods of fuzzy logic and artificial neural net-works and systems, that is, human-like style considerations of fuzzy systems with training and simulation of mental phi novena of neural networks.

Method. The paper analyzes modern areas of research in the field of information protection in information systems, methods and technologies of information security risk Assessments, use of vague models to solve problems of information security risk assessment, as well as concept and con-struction of ERP systems and analyze problems of their security and vulnerability.

Results. Identified factors influencing risk assessment suggest the use of linguistic variables to describe them and use fuzzy variables to assess their qualities, as well as a system of qualitative assessments. The choice of parameters for the development of the structure of a fuzzy product model of risk assessment and the basis of the rules of fuzzy logical conclusion justified.

Conclusions. A vague risk assessment model of ERP systems is considered. You have selected a list of factors that affect information security risk.  The methods of assessment of risks of information resources and ERP-systems in general, assessment of financial losses from the implementation of threats, determination of the type of risk according to its assessment for the formation of recommendations for their processing in order to maintain the level of protection of the ERP-system are considered. The list of linguistic variable models is considered. The structure of the database of fuzzy product rules – MISO-structure is selected.  Fuzzy variable models are considered. 

Author Biographies

A. D. Kozhukhivskyi, State University of Telecommunications, Kyiv

Dr. Sc., Professor, Professor, Department of Information and Cybernetic security

O. A. Kozhukhivska, State University of Telecommunications, Kyiv

Dr. Sc., Associate Professor, Department of Information and Cybernetic security

References

Methody zahysty systemy upravlinnia informaciinoiu Bezpekoiu [Tekst], DSTU ISO/IES 27001, 2015. Chyn. 2017.01.01. Kyiv, DP “UkrNDNC”, 2016, 22 p.

Informaciini tehnolohii. Metody zahystu. Zvid praktyk shchodo zahodiv informaciinoi bezpeky [Tekst], ISO/IES 27002:2015. 2015. Chyn. 2017.01.01. Kyiv, DP “UkrNDNC”, 2016.

Informaciini tehnolohii. Metody zahystu. Systemy keruvannia informaciinoiu bezpekoiu. Nastanova [Tekst]: DSTU ISO/IES 27003: 2018. Chyn. 2018.01. 01. Kyiv, DP “UkrNDNC”, 2018.

Informaciini tehnolohii. Metody zahystu. Systemy кeruvannia informaciinoiu bezpekoiu. Monitoring, Vymiriuvannia, analisuvannia ta ociniuvannia [Tekst]: DSTU ISO/IES 27004: 2015.–2018. Chyn. 2018.01.01. Kyiv: DP “UkrNDNC”, 2018.

Informaciini tehnolohii. Metody zahystu. Upravlinnia Rysykamy informaciinoi bezpeku [Tekst]: DSTU ISO / IES 27001: 2015 Chyn. 2015.01.01. Kyiv, DP “Ukr-NDNC”, 2016.

Ehlakov Yu. P. Nechyotkaya model ocenki riskov Prodvizheniya prohramnyh produktov, Biznes-informatika, 2014, No. 3 (29), pp. 69–78.

Gladysh S. V. Predstavlenie znanii ob upravlenii in- Cyndentami informacionnoj bezopasnosti posredstvom Nechyotkich vremennyh raskrashennyh Setei Petri, Mizhnarodnyi naukovo-tehnichnyi zhurnal “Informaciini tehnolohii ta kompyuterna inzheneriia”, 2010, No. 1 (17), pp. 57–64.

Nieto-Morote A. A., Ruz-Vila F. Fuzzy approach to construction Project risk assessment, International Journal of Project Management, 2011, Vol. 29, Issue 2, pp. 220– 231.

Korchenko A. G. Postroenie system zashchity Infor-macii na nechetkikh mnozhestvakh. Teoriya i Prakticheskiie resheniia. K., MK-Press, 2006, 320 p.

Teoriia alhoritmiv ta matematychna lohika [Elektronnyi resurs] / materialy dystanciinnogo Navchannia Sumskogo derzhavnogo universytetu, Rezhim dostupu: https://dl. Sum d u. edu.ua /textbooks/ 85292/354091/index.html.

Karpenko A. C. Lohika Lukaсevicha i prostye chisla. Moscow, Nauka, 2000, 319 p.

Zade L. Ponyatie lingvisticheskoi peremennoi i ego primenenie k ponyatiyu priblizhyonnykh reshenii, Per. s Angl. Moscow, Mir, 1976, 166 p.

Nechyotkaya i lingvisticheskaya peremennye [Elektronnyi resurs], Project Neuronus.com Portal Znanii Ob iskusstvennom intelekte. Rezhim dostupu: https://neuronus.com/theory/fl/310-chast-3-nechetkaya-ilingvisticheskaya-eremennye.html.

Neiro-nechitki merezhi. Nechitka logika v Matlab [Elektronnyi resurs] Yevropeiskii universitet Finansiv, informaciinykh system, menedzhmentu i Biznesu. Kurs lekcii “Ekspertni systemy. Intelektualni Informaciini systemy”, 2016, Rezhim dostupu: https://studfile.net/preview/5474324/page:3/.

Shutovskii V. O. Rozrobka adaptyvnogo algoritmu kilkisnoi ocinky ryzykiv z vykorystanniam metodiv nechitkoi logiky, Teoretychni i Prykladni problemy fizyky, mathematyky ta Informatyky. Zbirka tez dopovidei uchasnyki, 2008, P. 146.

Kruglov V. V., Borisov V. V., Fedulov A. C. Nechitki modeli i seti. Moscow, Goriachaya linia, Telekom, 2012, 284 s. Il.

Hayashi Y., Imura A. Fuzzy neural expert system with automated extraction of fuzzy If-Then rules from a trained neural network, Proceedings. First International Symposium on Uncertainty Mode Ling and Analysis, 1990, pp. 489–494.

Kruglov V. V., Borysov V. V. Iskusstvennye neironnye seti. Teoriya i praktika. Moscow, Goriachaya liniya – Telekom, 2002, 382 p.: Il.

Zagalna kharakterystyka ta vlastyvosti neiro-nechitkykh merezh [Elektronnyi resurs] //Informaciinyi sait nechitkoi logiky. Rezhym dostupu: https://sites.google.com/site/ ne4itkalogika, Nejro-necitki merezhi, zagalna harakteristika ta vlastivosti nejro-necitkih merezh.

Subbotin S. O. Podannia i obrobka znan u Systemach Shtuchnogo intelektu ta pidtrymky Pryiniattia Rishen: Navch. Posibnyk. Zaporizhzhia, ZNTU, 2008, 341 p.

Buckleya J. J., Hayashi Y. Fuzzy neural networks: asurvey, Fuzzy sets and systems, 1994, Vol. 66, Issue 1, pp. 1–13.

ERP-sistema (planuvannia resursiv pidpryemstva) [Elektronnyi resurs], Navchalni materialy onlain (pidruchniki-website). Rezhym dostupu: https://-pidruchniki. com / 1171062647760 / informatika Pidpriyemstva.

Zyryanov Yu. Informacionnaya bezopasnost ERP-sistem. CITforum. Rezhim dostupu: http://citforum.ru/gazeta/49/.

Hendrawirawan D., Tanriverdi H., Zetterlund C. ERP Security and Segregation Of duties Audit: A Framework for Building an utomated Solution, Information systems control journal, 2007, Vol. 2, 4 p.

Security issues in ERP. Security, Audit and Control Features SAP ERP 4th Edition, Audit Program. Isaca, 2015, 574 p.

Polyakov A. ERP Security Deserves Our Attention Now More than Ever [Elektronnyi resurs], Forbes, 2017. Rezhym dostupu: https://www.forbes.com/ sites / forbestechcouncil /2017/07/07/ erp-security-deserves-our-attention-now-more than-ever/.

Polyakov A. Bezopasnost SAP v cyfrakh [Elektronnyi resurs], Blog kompanii Digital Security. Khabrakhabar, 2012, Rezhym dostupu: https://habr.com/ru/company/ Dsec/blog/146967/.

Jang J.-S.R. ANFIS: Adaptive Network –based Fuzzy Inference System, IEEE Trans. On Syst., Man and Cybernetics, 1993, Vol. 23, No. 3, pp. 665–685.

Goel S., Kiran R., Carg D. Vulnerability Management for an Enterprise Resource Planning System, International Journal Of Computer Applications, 2012, Vol. 53,No. 4, pp. 19–22.

National vulnerability database Release [Elektronnyi resurs], National Institute of Standards and Technology. Rezhym dostupu: https://nvd.nist.gov/vuln-metrics/cvss.

Downloads

How to Cite

Kozhukhivskyi, A. D., & Kozhukhivska, O. A. (2020). ERP-SYSTEM RISK ASSESSMENT METHODS AND MODELS. Radio Electronics, Computer Science, Control, (4), 151–162. https://doi.org/10.15588/1607-3274-2020-4-15

Issue

Section

Progressive information technologies