Стаття присвячена детальному розгляду Cybersecurity Framework версії 2.0, який був представлений Національним Інститутом стандартів і технологій (NIST, National Institute of Standards and Technology) на початку 2024 року. CSF 2.0 створений для ефективного управління та зменшення ризиків в області кібербезпеки для різноманітних організацій, незалежно від їх розміру та сфери діяльності. Стаття розкриває ключові компоненти фреймворку, такі як Ядро (CSF Core), Організаційні профілі (CSF Organizational Profiles), Рівні безпеки (CSF Tiers), і надає інформацію щодо їхнього використання для покращення кібербезпекових практик організацій. Підкреслюється гнучкість фреймворку, яка дозволяє організаціям адаптувати свої підходи до управління кібербезпекою відповідно до їхніх унікальних ризиків та потреб. CSF 2.0 розглядається як важливий інструмент, призначений сприяти покращенню кібербезпеки на всіх рівнях організацій, незалежно від їхнього рівня технічної зрілості. Стаття також надає загальне уявлення про можливості використання ресурсів CSF для покращення кібербезпекових практик та наголошує на важливості постійного вдосконалення стратегій управління кібербезпекою для ефективного протистояння зростаючим кіберзагрозам.

In the modern world, where more and more aspects of our lives become dependent on computer systems and networks, cybersecurity becomes increasingly critical. One of the key elements of cybersecurity is protecting the software used in these systems. Software can contain vulnerabilities that attackers can exploit to gain unauthorized access to systems, data, and resources. These vulnerabilities may arise from coding errors, improper configurations, or inadequate software updates. Attackers continuously refine their methods and tactics not only to exploit software vulnerabilities but also to influence their emergence by targeting the supply chain. This makes software cybersecurity an increasingly complex challenge. This article addresses the pressing issue of cybersecurity in the context of the proliferation of cyberattacks on software, including supply chain attacks. Examples of known cyberattacks targeting the supply chain are provided. The shortcomings in the existing system of standards and rules for secure software development are highlighted, as well as the lack of security requirements and vulnerability management. A comprehensive approach to ensuring software security is proposed, which includes the development of appropriate requirements, standards, and control mechanisms.

An urgent problem of the implementation of the security information end event management of the critical information infrastructure objects is the objective assessment of the state of information security, as well as the effectiveness of security management measures. The optimal choice of monitoring, parameterization, analysis, and evaluation of information security events (incidents) ensures the necessary effectiveness of information security management decisions. An effective comprehensive security indicator, which simultaneously considers objective data about events and the subjective assessment of independent experts (auditors), is the proposed local cybersecurity index (LCSI). The main components of LCSI are indexes (sub-indexes) of network monitoring (NMI) and information security audit (AI). NMI determines the level of protection of a computer network and/or information resources based on the analysis of network data, AI based on the analysis of audit results, or another type of expert assessment. The purpose of this work is the analysis of existing indexes and indicators of cybersecurity and the NMI formation based on this analysis. The authors analyzed fifteen existing cybersecurity indexes that contain a network component. The work examines the sources and ways of forming indexes, the purpose of indexes, as well as the objects of network analysis. It was determined that the objects of analysis are network components, end equipment, web resources, and the state of their protection. The state of protection is determined by secondary characteristics based on traffic analysis or external vulnerability scanning network analysis objects. The NMI model is proposed, which considers network traffic analysis data, vulnerability scan results, and threat intelligence data. Calculation data of the NMI for critical information infrastructure objects are in progress.

З розвитком інформаційних технологій збільшились потреби щодо вирішення задачі захисту інформації, оскільки вона стала найважливішим стратегічним ресурсом. Водночас, збільшується вразливість сучасного інформаційного суспільства до недостовірної інформації, несвоєчасного надходження інформації, промислового шпигунства, комп’ютерної злочинності, тощо. В такому разі швидкість виявлення загрози, в контексті добування системної інформації про зловмисників і можливих технік та інструментів реалізації кібератак з метою їх опису та оперативного реагування на них є однією з актуальних задач. Зокрема, постає задача у застосуванні нових систем збору інформації про кіберподії, реагування на них, зберігання та обмін цією інформацією, а також на її основі способів та засобів пошуку зловмисників за допомогою комплексних систем, або платформ. Для вирішення задач такого типу досліджується перспективний напрямок Threat Intelligence як новий механізм отримання знань про кібератаки. Визначено Threat Intelligence в задачах забезпечення кіберзахисту. Проведено аналіз індикаторів кібератак та інструменти їх отримання. Здійснено порівняння стандартів опису індикаторів компрометації та платформ їх обробки. Розроблено методику Threat Intelligence в задачах оперативного виявлення та блокування кіберзагроз державним інформаційним ресурсам. Ця методика дає можливість покращити продуктивність роботи аналітиків кібербезпеки та підвищити захищеність ресурсів та інформаційних систем.

The development and widespread introduction of the Internet into everyday life has transformed both economic and social relations. The representation of these relations in digital form has created a digital economy, characterized by an active exchange of information, quick access to information resources, and the transfer of payments to the digital dimension. Social relations in the digital world are represented by social networks, instant messengers, which also provide economic services. At the same time, the new space, the transformed economy and social relations give rise to new threats. Users themselves actively expose information about themselves and their loved ones, photos of vacations and locations to the public. In addition to social networking, viewing entertainment content and online games, bank settlement transactions are popular. The popularization of Internet banking leads to an increased interest in stealing data from intruders. The result of this is an increase in the number of scammers who aim to obtain confidential user information. In addition, since the beginning of the war, the number of cyber attacks on public authorities, critical information infrastructure facilities and organizations containing critical information has increased. One of the well-known methods of stealing such information is phishing attacks. At the same time, most users underestimate the severity of these attacks and do not pay enough attention to protection systems. This, in turn, leads to wider consequences. Therefore, the problem to be solved is to present a method for analyzing phishing messages that can be used to reduce the probability of reaching the goal of a phishing attack. At the same time, it is known that attackers improve and modify the methods of implementing attacks, and therefore, classifying phishing attacks to increase user awareness is an urgent task. The result of the work is the proposed classification of phishing attacks and the presented method for analyzing phishing messages.

The report is devoted to analyzing and classifying cybersecurity indices developed and implemented by leading global, international, and local organizations as of early 2021. It is proposed to include regular (periodic) information materials, which contain expert, analytical, statistical information on the state of cybersecurity and the level of protection of indexing subjects (rating), as well as on certain indicators regarding the harmful impact of implemented information security and cybersecurity threats, to cybersecurity indices. 65 existing cybersecurity indices and approaches for their formation are described. The definition of the terms necessary for the analysis of indexing (rating) in the field of information security and cybersecurity is offered.

Domestic and foreign regulations related to the protection of web applications are analyzed. It is established that the requirements for its individual means of protection should be taken into account when developing a comprehensive information protection system. The most effective of the elements of the complex of means of protection for automated systems of class 2 and 3, on which web servers operate is the firewall of web applications, which is not required in open sources. Therefore, the development of such requirements is an urgent and urgent problem, the solution of which will simplify the development of a comprehensive information security system. Based on the relevance of the results of the work are the requirements for firewalls of web applications. One of the few open sources that allows you to implement such a component of a comprehensive information security system as the firewall of web applications is a list of rules from MITRE and the open project to ensure the security of web applications OWASP. However, these rules do not implement the developed requirements, so in addition, proposed and implemented rules for filtering the firewalls of web applications that meet them. The technique of their check on conformity to the established requirements is formed. Based on such utilities as Metasploit FW, nikto, dirb, wafninja, a software application has been developed that implements this technique. It has a direct link to the CVE database, which allows you to detect and check for current vulnerabilities. OWASP ModSecurity is used as a security component, the source code of which is located on official repositories and operates on the basis of the nginx web server. The capabilities of ModSecurity are enhanced by a developed dynamic connector that allows you to use the firewall of web applications as a separate means of protecting information. Certain filtering rules are implemented in the developed protection tool. This satisfies the requirements for a set of security features in a comprehensive information security system such as continuous protection of computer systems and a modular structure.

The article deals with the levels, types and kinds of cyber-training and provides a generalized classification. Such types of cyber-training as Capture the Flag and Cyber Range (Red Team / Blue Team) are considered in detail. As a separate approach, the gamification of cybertraining in the form of board and computer games is highlighted and analyzed. Further promising areas of research in the field of organization and conduct of cyber-training are suggested.

The solution to the problem of secure data centers for storage of information and state electronic information resources is offered through the implementation of cloud technologies. State regulatory acts don`t solve the problem of providing security status during the remote processing of information in data centers using cloud technologies, so the experience of international standards and best practices in this field are analyzed. The purpose of the article is to analyze the problem of information resources protection when using cloud technologies. To achieve this goal, cloud computing technologies are analyzed and comparative analysis of regulatory documents on information security when using cloud technologies is conducted. Unique definitions and characteristics of cloud computing which differentiate them from other types of computing technologies are also described, including such terms as on-demand self-service, resource pooling, instant resilience of resources, measured service. The classification and analysis of organizations and authorities that develop regulatory documents in the sphere of cloud computing is provided and described. These establishments work on making international standards and have the following hierarchy of levels: international (ISO / IEC), interstate (forums and consortia (Cisco, CSA)), regional (European ETSI, CEN / CENELEC), national (laws and national standards, departmental regulations) , guides, instructions, for example: (NIST). The great consortia's role in standardizing and developing both cloud technologies and information protection issues when using them is highlighted. The description of these consortia and their activity vectors are outlined. The documents, created by them, in the field of cloud security are reviewed and compared to ISO 17788, NIST SP 500-299, Security Guidelines for Critical Cloud Computing CSAs and GOST R "Information Protection. Requirements for the protection of information, processed with using the technology of "cloud computing". Basic provisions". Basing on the conducted analysis, the reflection of service models in the regulatory documents is presented and the information on the methods of data protection in the field of cloud computing, which is available in the documents, is summarized.

Leading modern organizations that use advanced technologies in their business processes require a high-level approach to managing the cybedefence process, regardless of the appointment of technical means usage - introspection technology (IT), industrial control systems (ICS), cyberphysical systems (CPS), or IoT devices. Therefore, the main task of IS specialists lies in the choice of standards and frameworks in the field of information technology, which contain requirements, guidelines and recommendations for the organization of up-to-date processes of cyberdefense and information security management. Security Operations Centers (SOCs), which functionate under the guidance of organizations, operate on the basis of admitted and documented usage of standards and recommendations. As for today, the problematic issue lies either in documenting instructions for the implementation of their own SOCs as they differ in functionality depending on goals and scale of implementation, available financial resources or models for assessing the maturity and capabilities of SOCs, most of which are poorly described and suggested with IT industry leaders as a commercial service. The purpose of this work is to analyze the functioning of maturity and capability assessment models in the management strategy of organization`s information security sphere and to create the functional model of assessing the level of SOC maturity, which is based on the chosen maturity model. The results of a such model`s implementation allow us to use a single approach in the process of assessing the maturity level of both individual domains and SOC in general, regardless of the choice of a maturity model with analyzing the calculations from simple metrics of achieving goals (Key Result Indicators, KRI) to business-oriented metrics. The subsequent model decomposition enables to formulate specific requirements for simple metrics on which the calculation of complex metrics is based, as well as more precisely determine the methods of analysis of the performed calculations.

The factorization problem, which is the basis for many classical asymmetric cryptosystems (RSA, Rabin, and others) and a cryptographically strong generator of pseudo-random sequences (PBS), has been investigated in this paper. The methods that served as prototypes for the Lenstra method were described, the method for factorization of numbers, which is analogous to the Lenstra method on Edwards curves, has been proposed. To substantiate the correctness of the method, an appropriate mathematical apparatus was developed. In addition, an analog of the Lenstra method on Edwards curves was constructed with the use of the presented apparatus; the appropriate algorithm for the factorization of numbers was designed. The correctness of the method and correctness of the algorithm operation were substantiated mathematically; the top analytical estimates of its performance speed, as well as the lower estimates of success probability, have been strictly proved. The advantages of the developed method in comparison with the classical Lenstra method, which applies elliptic curves in the Weierstrass form, were presented and strictly substantiated. A comparative analysis of the new and the classical algorithms was performed. Results of the research provided a strict proof that the new algorithm on full Edwards curves, in comparison with the classic one, has some advantages in terms of performance speed, by about 1.5 times. The presented experimental results show that the performance speed increases even larger (by up to 30 per cent) in case the twisted and quadratic curves are used instead of full Edwards curves. It was shown that the assessment of probability of success of the new method increases due to the emergence of new conditions that lead to success of the algorithm that are not satisfied for the classical Lenstra algorithm on Weierstrass curves. The obtained results make it possible to decrease the time required for solving the problem on factorization by approximately 1.5 times, and thus, enable the faster breaking of cryptosystems whose stability is based on this problem

In general, the issue of building cybersecurity centers mainly stands for building a SOC which main function is monitoring and analyzing cybercrime questions and responding to cyber incidents online. The approach, mentioned above, implies insufficient attention to the stages of intrusions` prevention and the elimination of cyber attacks` outcomes. Conducted investigations represent the possibility of SOCs` functions expanding , but they are not formalized and described in terms of functions, which rely on such Cybersecurity Situation Center (hereinafter referred to as the CSSC). The aim of this work is to analyze the existing cybersecurity models and build a functional model of modern cyberprotection center. The article reviews cyberattacks` analyzing models from the position of a researcher (Diamond Model and Q Model), the implementation of cyberattacks from the position of an attacker (Model Cyber Kill-Chain) and models with a wider range of analytical approaches (Adaptive Safety Model) to achieve this goal. The functions of cyberprotection before, during and after cyberattacks have been determined taking into consideration data needs for cyberattack analysis, understanding of cyberattacks` realization stages and the Adaptive Security System`s architecture. The results of the selected models` analysis allow to suggest a new organizational model of a modern cyberprotection center as well as define it`s components and formulate main functions. The implementation of the CSSC is proposed to be realized through the construction of Cybercrime Intelligence Unit, Monitoring and Incident Security Control Unit and Cyber Incident Response Team. The mentioned model represents logical links between structures and information streams which circulate between them. The presented functional model of A-0 and A0 levels is based on the IDEF notations` requirements. The main cyberprotection center`s function, input and output data as well as the resources used in the process of center functioning , main restrictions under which the modern center operates are determined. The presented notations display the visualisations which demonstrate the results of the cyberprotection center`s functional analysis. They also give an opportunity to determine requirements for the center`s components, form the organizational structure of each unit and establish each employee`s functional responsibilities in subsequent decomposition.

In this article, the analysis of the main protocols of the creation of the virtual private networks which are widely used in case of creation of the protected connections on networks of general purpose is carried out. Possible types of implementations of the virtual private networks are marked and examples of the modern telecommunication equipment which uses the virtual protected connections for information security which is transferred by open channels of communication are given. At the same time, it is certain that all leading telecommunication companies have the equipment for the creation of the protected virtual area networks. Characteristics of such main protocols as IPSec, by PPTP, L2TP and TLS are provided. Their structure is considered and analyzed, figures of the logical creation of each protocol and also their advantage and shortcomings are given. The list of cryptographic algorithms which are used in these protocols is provided. The analyzed protocols work at different levels of the open system interconnection model but have common features of creation and cryptographic algorithms which are used. Yes, each of the analyzed protocols has subprotocols which are responsible for tunneling, authentication, encryption, and support of the integrity of data. However, each of them contains the possible implementations of cryptographic algorithms. It is certain that perspective option of development the virtual private area networks technologies for information security which is the property of the state during its transfer over open channels of communication are used in an implementation of the virtual private area networks of cryptographic algorithms which are passed a State expertise. It can be an algorithm of block encryption of GSTU 7624: 2014, hashing algorithm GSTU 7564: 2014 and algorithm of the digital signature of GSTU 4145: 2002.

In our time, asymmetric cryptoalgorithms are widely used in solving the problem of cryptographic protection of information, especially in information and communica­tion systems, they include RSA algorithm that has become the most popular. Existing publications mainly reveal the application of RSA algorithm, its primitives in other cryp­toalgorithms, analyzing die stability of these cryptosys- tems. Besides, these publications do not provide a com­prehensive description of the applications of RSA algo­rithm. Analyzed sources shows that RSA algorithm and the procedure for its application are described in a num­ber of international, national and industry standards. This article also presents specific examples of using RSA algo­rithm in the protocols of information and telecommuni­cation systems, and in hardware and software for die realization of cryptographic protection. The analysis shows that despite the appearance of new and more so­phisticated asymmetric encryption algorithms in recent years, RSA algorithm is still widely represented in modern information and telecommunication systems to provide cryptographic security problems, including in our country, as it calls for a more detailed study.

В статье предлагается подход, позволяющий свести задачу факторизации нечетного составного числа, разряды которого являются значениями компонентов вектора правых частей системы нелинейных алгебраических уравнений с разрядными связями, к системе уравнений в алгебре Жегалкина путем построения и учета явных выражений для функций трансфера значений разрядных переносов.