Analysis of the architecture and functions of protected automated systems installed at internal affairs facilities

Abstract

Aim. One of the key objectives of the theory and practice of information security is to analyse the functioning of protected automated systems, particularly those operated at computerized facilities of internal affairs bodies. In order to identify potential threats to resources of confidential information, to assess the risk of threat implementation, as well as to form a list of potential threats to automated systems installed at computerized facilities of internal affairs bodies, it is necessary to analyse the composition and architecture of automated systems, identify the features of their protected functioning and determine the vulnerability of software and hardware systems. Methods. A comprehensive analysis of the functioning of protected automated systems during their operation at computerized facilities of internal affairs bodies was conducted. Results. Following an analysis of normative documentation and research publications in the field of protecting information in automated systems, departmental records of the Ministry of Internal Affairs of the Russian Federation, regulations for the protection of information at computerized facilities of internal affairs bodies, the structure and architecture of a protected automated system were defined. Potential threats to the functioning of such a system, including cyber attacks, were identified. On the basis of a survey among experts in the field of information security, the vulnerability (in term of cyber attacks) of the software components of an automated system installed at computerized facilities of internal affairs bodies was analysed. Conclusion. The results can be used in the process of designing and operating information security tools and systems installed at computerized facilities of internal affairs bodies for the purpose of improving their security.

Keywords

• automated system
• vulnerability
• threat
• unauthorized access
• cyber attack
• information protection