Control Systems and Computers

https://doi.org/10.15407/usim.2019.01.068

Upr. sist. maš., 2019, Issue 1 (279), pp. 68-75.

UDC 004.9:004.75

Yu.M. LISETSKYI, Dr. of Eng. Sci., General Director, DP «S&T UKRAINE», Prosp. Akad. Palladina, 03680, Kiev, Ukraine 44,
Iurii.Lysetskyi@snt.ua

COMPLEX SECURITY OF THE CORPORATE INFORMATION SYSTEMS

Introduction. Implementation of a corporate information system (CIS) for any modern organization requires special attention to be paid to the issue of information security. This problem has recently grown extremely important as more and more CIS and data they store become the object of strategic interest. This brought about the endless search for tools and ways of unauthorized data access. To ensure complex information security of the CIS there is to be built a reliable architecture of the corporate system of the information security.

Components of the Corporate System of Information Security. Electronic information accessed by the corporate system is to possess the following qualities: confidentiality, authenticity, integrity, accessibility. They are to be provided by the corporate system of the information security, thus, it is to contain the complementary components with different functions: network segmentation, firewalls, authentication system, cryptoprotection, intrusion detection and reaction system, server and workstation security system, anti-virus system, detailed content control system.

Requirements to the Corporate System of Information Security and its Architecture. To provide complex security there exist the following requirements to the CIS protection systems: granular determined access to corporate networks resources based on the analysis of IP-addresses, ports, devices, applications and geolocation data; anti-virus protection of the network information; anti-spam protection of the mailing systems; advanced and “zero day” threats prevention; DDoS-protection; leakage prevention and integrity protection of the critical information; protection from threats and vulnerabilities of corporate portals, Web-applications used to access databases, browsers etc.; centralized and coherent management of protection tools; provision of security risks analysis and retrospective analysis tool.

Conclusion. This way the modern CIS requires implementation of the whole complex of hardware and software devices for its protection. Complex usage of the described components of the corporate system of the information security enables protection from the most known types of attacks. It is also shown that development of effective and reliable architecture of the corporate system of information security is an important and urgent task.

Download full text! (In Russian)

Keywords: corporate informative system, informative safety, components, architecture, network segmentation, demilitarized zone, firewall, authentification, cryptoprotection, DDoS-attack, cyber attack.

1. Koneev I.R., 2003. Enterprise Information Security. Saint-Petersburg: BHV-Petersburg, 752 p. (In Russian).
2. Lysetskyi Y.M., 2016. «Some Aspects of Complex Security of Corporate Networks». Proceedings of the 5^th International Scientific and Practical Conference on Informational Management Systems and Technologies, Odessa, pp. 145–148. (In Ukrainian).
3. Gerasimenko V.A., 1994. Protection of Information in Automatic Data Procession Systems. Book 1. Moscow: EnergyAtomIzdat, 400 p. (In Russian).
4. Melyuk A.A., Pazizin S.V., Pogozhin N.S., 2001. Introduction to Protection of Information in Automated Systems. Moscow: Goryachaya Liniya – Telecom, 48 p.  (In Russian).
5. Ogltry T., 2001. Practical Application of Firewalls. Moscow: DMD Press, 400 p. (In Russian).
6. Babenko L.K., Ischukova E.A., 2006. Modern Algorithms of Block Cyphering and Methods of their Analysis. Moscow: Gelios ARV, 376 p. (In Russian).
7. Tchmora A.L. 2002. Modern Applied Cryptography. 2nd edition. Moscow: Gelios ARV, 256 p. (In Russian).
8. Schneier B., 2002. Applied Cryptography. Moscow: Triumph. 816 p. (In Russian).
9. Ferguson N., Schneier B., 2005. Applied Cryptography. Moscow: Williams, 424 p. (In Russian).
10. Anin B. Y., 2000. Protection of Computer Information. Saint-Petersburg: BHV- Saint-Petersburg, 384 p. (In Russian).
11. Sokolov A.V., Stepanyuk A.V., 2002. Manual on Protection from Computer Terrorism. Saint-Petersburg: BHV-Saint-Petersburg, Arlit, 496 p. (In Russian).
12. Litvinov V.V., Kazimir V.V., Rindich E.V., 2009. Modern State of Information Protection in IP-Telephony. Mathematical Machines and Systems. 2009. № 2. 76–84 pp. (In Ukrainian).
13. Korneev V.V., Gareev A.F., Vasyuti S.V., Ie, 2001. Databases. Intellectual Procession. Moscow: Knowledge, 496 p. (In Russian).
14. Lysetskyi Y.M., 2014. «Information Security: Protection from DDoS-Attacks». Proceedings of the 16^th International Conference «System Analysis and Information Technologies SAIT, Kiev, 405–406 pp. (In Ukrainian).
15. Simon A., 1999. Databases Strategic Technologies. Moscow: Finance and Statistics, 484 p. (In Russian).

Received 14.12.2018