Open AccessDEVELOPMENT OF CYBERSECURITY AUDIT METHODOLOGY FOR STATE INFORMATION SYSTEMS RELATED TO SIGNIFICANT OBJECTS OF CRITICAL INFORMATION INFRASTRUCTURE OPERATING ON THE BASIS OF DATA CENTERS
Author(s) -
Vladimir R. An,
Valeria A. Tabakaeva,
Valentin Selifanov
Publication year - 2020
Publication title -
interèkspo geo-sibirʹ
Language(s) - English
Resource type - Journals
ISSN - 2618-981X
DOI - 10.33764/2618-981x-2020-6-1-22-30
Subject(s) - audit , computer security , computer science , information system , vulnerability (computing) , state (computer science) , audit trail , information technology audit , legislation , legislature , information security , risk analysis (engineering) , accounting , business , engineering , internal audit , law , joint audit , algorithm , political science , electrical engineering
The problem of developing a cybersecurity audit methodology for state information systems related to significant objects (SO) of critical information infrastructure (CII), operating on the basis of data centers is considered. In accordance with the requirements of the legislation, state control is carried out in accordance with the Order of the FSTEC of Russia dated February 11, 2013 №17 “Requirements. Ensuring the protection of information not constituting a state secret.” Currently, there are many international and domestic recommendations and practices to conducting cybersecurity audit of information systems, but they do not meet the existing and emerging requirements in the field of cybersecurity of SO CII of the Russian Federation and cannot be applied without significant improvement. The authors consider the issues that need to be solved in order to develop an audit methodology, analyze existing legislative and regulatory acts of the Russian Federation and Federal Executive bodies authorized in this area, methodological documents (MD) and standards, as well as possible reasons for the current situation. An algorithm of possible actions for conducting a cybersecurity audit in the course of state control is proposed. The algorithm is a result of compiling international practices (standards) and requirements adopted in the Russian Federation, as well as requirements to the necessary tools - vulnerability analysis systems and support software (database management systems).