ENSURING THE SECURITY OF COMPLEX INFORMATION AND TECHNOLOGICAL SYSTEMS OF CRITICAL INFRASTRUCTURE FACILITIES

This article highlights the critical aspects of ensuring the security of complex information systems of critical infrastructure (CI) facilities in the face of modern threats, in particular, armed aggression and cyberattacks. The author emphasizes the high interdependence of CI elements and their vulnerability to new types of threats despite significant protection efforts. The author identifies four types of objects according to the level of potential danger and the peculiarities of CI functioning as a set of interconnected cyber-physical elements that require an integrated approach to protection. Three main approaches to ensuring security are analyzed in detail: the normative approach, which is based on the use of clearly defined norms, standards and regulations. Probabilistic approach (reliability): based on an assessment of the probability of reaching a threshold state under cyber impact. Risk approach (risk management): an integral approach based on an assessment of the probability of realization of limit states (P) and possible losses (L) from such realization. The article provides a comparative analysis of these approaches, identifies their advantages and disadvantages, and considers the conditions under which they may be equivalent.

It is shown that although the normative approach is basic, the probabilistic and risk approaches provide more reasonable and mathematically correct means of taking into account uncertainties and optimizing protection. The author emphasizes the need to combine the advantages of different approaches to create truly secure CI systems.