INTEGRATED INFORMATION SECURITY RISK ASSESSMENT BASED ON BAYESIAN NETWORKS AND MATURITY AUDIT

A fundamental element of any security architecture is risk assessment, which allows you to systematize potential threats and predict their impact on the confidentiality, integrity and availability of information assets. This study highlights the issue of probabilistic risk modeling using specialized tools, in particular Bayesian networks (BN) and the Microsoft Security Assessment Tool (MSAT). This approach allows not only to visualize the topology of threats, but also to mathematically substantiate the cause-and-effect relationships between vulnerabilities and possible losses. The conducted analysis of scientific sources allowed us to systematize existing methods, from classic questionnaires to complex mathematical models for assessing information security risks, in particular SWOT analysis, expert method, normative method, game theory, fuzzy cognitive maps, as well as the use of neural network models. The practical significance of the study lies in the development and testing of a comprehensive methodology for assessing the security of a hypothetical organization. This methodology is based on quantitative modeling using the GeNIe Modeler software package and a qualitative audit of the maturity of the security system using the Microsoft Security Assessment Tool. Comparative analysis showed that MSAT is a reliable tool for identifying gaps in compliance and organizational protection, while Bayesian networks provide a deeper quantitative analysis of the criticality of risks, allowing modeling the effectiveness of implementing specific countermeasures. The results of the study have both theoretical and applied significance. The developed models and methodological recommendations were implemented in the educational process when training specialists in the specialty F5 "Cybersecurity and Information Protection" at the Borys Grinchenko Kyiv Metropolitan University. This confirms the feasibility of using combined intelligent systems for making informed decisions in the field of digital infrastructure risk management.