Methods for Maintaining the Observability of Information and Communication Infrastructure in Conditions of Full-Scale War

Specific technical methods have been developed for maintaining the observability of infor-mation and communication infrastructure in conditions of full-scale war. The focus is on main-taining infrastructure surveillance and controllability of cybersecurity operations center pro-cesses in conditions of physical destruction, telemetry degradation, dynamic architecture changes, personnel crisis, and heterogeneous trust in distributed infrastructure under the exist-ing event and incident management system. The problem is formulated as a consequence of environmental variability and loss of telemetry, which creates “blind spots” in monitoring and reduces the ma¬nageability of response processes. An adapted security asset management mod-el is proposed, in which each computer system is described by an ordered set of attributes suf-ficient for policies, controls, and responses in a dynamic topology. Inventory attributes are de-fined, especially threat descriptors that affect time metrics and reduce the proportion of false decisions. A metric for threat profile protection compliance is proposed as a weighted propor-tion of practically observable adversary techniques for prioritizing gap elimination and improv-ing detection and response effectiveness.