CYBER RESILIENCE ASSESSMENT METRICS (ANALYTICAL AND REVIEW RESEARCH)

Abstract

Recent events in Ukraine and the world have raised the acute issue of the ability of facilities and organizations to maintain an adequate level of functioning despite external cyber influences and limited resources. That is why, in today's realities, ensuring cyber resilience plays an extremely important role for entire sectors of industry, IT systems, and, as the modern hybrid war has shown, for the vital activity of entire states. In particular, cyberattacks in the energy sector or on other critical infrastructure can affect not only the sector itself, but also the economy as a whole and the entire structure of the state, both social and organizational. The purpose of the article is to formulate the conceptual apparatus of cyber resilience and analyze metrics for assessing cyber resilience. The subject of the analysis and review of the material for writing the article were the leading methodologies for assessing cyber resilience, namely: the Linkov Group methodology, the CERT Resilience Management Methodology (CERT-RMM) and the MITRE Cyber Resilience Engineering Framework. The scientific novelty of this article is the introduction of the conceptual apparatus and a comprehensive analysis of cyber resilience metrics to the scientific field in Ukraine. The article compares and contrasts the leading metrics for assessing cyber resilience. Conclusions. The article interprets the conceptual apparatus of the term cyber resilience, examines the difference between cybersecurity and cyber resilience. In the course of the study, it was found that the main systems and metrics for assessing cyber resilience have a fairly similar general structure (goals and domains), but are not derived from each other. The engineering structure of cyber resilience was analyzed and the general resilience matrix was interpreted for the Ukrainian version. It is proposed to conduct research in the direction of comparing cyber resilience assessment systems and developing frameworks for real IT objects in Ukraine.