METHODOLOGY FOR DEVELOPING INFORMATION SECURITY MANAGEMENT SYSTEMS USING NETWORK ANALYSIS AND GAME THEORY

Abstract

In the context of digitalization and the rapid evolution of cyber threats, building a reliable Information Security Management System (ISMS) becomes critically important. Existing international and national ISMS standards do not take into account the specifics of resource allocation; instead, they only emphasize the importance of providing resources for the creation, implementation, maintenance, and continuous improvement of ISMS. This indicates a certain lack of mechanisms for making management decisions and optimizing allocated resources. Therefore, the problem of identifying, distributing, and rationally using resources to achieve an adequate level of ISMS efficiency remains relevant. Moreover, during ISMS implementation based on any methodology, one of the most challenging steps is the identification and integration of effective information security measures and tools. In this context, there is a shortage of practical and methodological optimization tools, since even with substantial investments and large-scale deployment of information security measures (ISMs), doubts may arise regarding the expediency and efficiency of such solutions. This paper proposes a methodology for building ISMS that combines the Analytic Hierarchy Process (AHP), network analysis methods, and the mathematical apparatus of game theory to select the optimal baseline methodology and protection tools under conditions of limited resources and existing threats. The proposed approach also involves the use of network analysis to model the project, taking into account timelines, costs, resources, and possible implementation scenarios.The methodology includes the construction of a project network model, calculation of the critical path, identification of critical and non-critical activities, analysis of time reserves, acceleration options, and assessment of the impact of acceleration on total cost. A method for comparative evaluation of several implementation scenarios is proposed: with normal timelines, with acceleration of only critical activities, as well as with acceleration of all or only non-critical activities. As a result, resource allocation over time, financial cost, and human resource engagement charts are obtained, enabling more informed management decisions. The methodology is a practical tool for the Chief Information Security Officer (CISO) and executives, allowing them to determine the optimal investment amount at each stage of the ISMS project and to substantiate resource requirements while ensuring a balance between efficiency and cost.