A systems approach to modeling incident response work in information security for a corporate information system

Abstract

The paper discusses a systematic approach to modeling incident response processes for information security in a corporate information system. To increase the effectiveness of information protection efforts, it is proposed to utilize a budget fund that accumulates and then disburses necessary financial resources. Corporate information system security is ensured under a financial constraint, making the introduction of new indicators in the form of single-factor financial risks essential. The budget fund manages the interaction of financial flows for accumulation and expenditure. Complex interconnections create a systemic effect known as emergence. In this case, the process describing the fund's state becomes non-stationary, although the interacting flows are either regular or stationary. For modeling this process, specialized algorithmic support has been developed based on an event calendar. The simulation progresses from event to event, with each event code having a dedicated subroutine created for handling it. A crucial component of these subroutines is the scheduling of the next event with the same code. The proposed mathematical support, accounting for new performance indicators, is implemented as software, with a simulation program based on discrete-event modeling as its core. The software was developed using the Python programming language, version 3.12. The system utilizes various Python modules (csv, random, sys, time, math, etc.). To simulate random variable values representing incident intervals and response costs, the simulation program supports various probability distributions, chosen for their applicability in risk theory, simulation modeling, and actuarial mathematics. Testing of the developed software and algorithmic framework confirmed its functionality, yielding both scientific and practical recommendations.