Integrated information security risk assessment based on bayesian networks and maturity audit

Шевченко, Світлана Миколаївна and Жданова, Юлія Дмитрівна and Стороженко, Валерія Андріївна and Рашевська, Валерія Олександрівна and Горбач, Володимир Володимирович (2026) Integrated information security risk assessment based on bayesian networks and maturity audit Електронне фахове наукове видання «Кібербезпека: освіта, наука, техніка», 4 (32). pp. 892-907. ISSN 2663-4023

Text S_Shevchenko_Yu_Zhdanovа_V_ Storozhenko_V_Rashevska_V_ Horbach CEST_4_32_2026.pdf - Published Version Download (1MB)

Abstract

A fundamental element of any security architecture is risk assessment, which allows you to systematize potential threats and predict their impact on the confidentiality, integrity and availability of information assets. This study highlights the issue of probabilistic risk modeling using specialized tools, in particular Bayesian networks (BN) and the Microsoft Security Assessment Tool (MSAT). This approach allows not only to visualize the topology of threats, but also to mathematically substantiate the cause-and-effect relationships between vulnerabilities and possible losses. The conducted analysis of scientific sources allowed us to systematize existing methods, from classic questionnaires to complex mathematical models for assessing information security risks, in particular SWOT analysis, expert method, normative method, game theory, fuzzy cognitive maps, as well as the use of neural network models. The practical significance of the study lies in the development and testing of a comprehensive methodology for assessing the security of a hypothetical organization. This methodology is based on quantitative modeling using the GeNIe Modeler software package and a qualitative audit of the maturity of the security system using the Microsoft Security Assessment Tool. Comparative analysis showed that MSAT is a reliable tool for identifying gaps in compliance and organizational protection, while Bayesian networks provide a deeper quantitative analysis of the criticality of risks, allowing modeling the effectiveness of implementing specific countermeasures. The results of the study have both theoretical and applied significance. The developed models and methodological recommendations were implemented in the educational process when training specialists in the specialty F5 "Cybersecurity and Information Protection" at the Borys Grinchenko Kyiv Metropolitan University. This confirms the feasibility of using combined intelligent systems for making informed decisions in the field of digital infrastructure risk management.

Item Type:	Article
Uncontrolled Keywords:	information security; cybersecurity; information security risks; cyber risks; information protection; Microsoft Security Assessment Tool (MSAT); GeNIe Modeler software package; Bayesian networks (BN)
Subjects:	Статті у періодичних виданнях > Фахові (входять до переліку фахових, затверджений МОН)
Divisions:	Факультет інформаційних технологій та математики > Кафедра інформаційної та кібернетичної безпеки ім. професора Володимира Бурячка
Depositing User:	Ю. Д. Жданова
Date Deposited:	16 Apr 2026 14:46
Last Modified:	16 Apr 2026 14:46
URI:	https://elibrary.kubg.edu.ua/id/eprint/56908

Actions (login required)

View Item