title: ÐÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¸Ðµ Ð°ÑÐ´Ð¸ÑÐ° Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ¸ÑÑÐµÐ¼Ñ Ð¸ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¼ÐµÑ Ð¿ÑÐ¾ÑÐ¸Ð²Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ñ Ð²ÑÑÐ²Ð»ÐµÐ½Ð½ÑÐ¼ ÑÐ³ÑÐ¾Ð·Ð°Ð¼ Ð´Ð»Ñ Ð¿Ð¾Ð´ÑÐ°Ð·Ð´ÐµÐ»ÐµÐ½Ð¸Ñ Ð¼Ð°ÑÐ¸Ð½Ð¾ÑÑÑÐ¾Ð¸ÑÐµÐ»ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐµÐ´Ð¿ÑÐ¸ÑÑÐ¸Ñ
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð±Ð°ÐºÐ°Ð»Ð°Ð²ÑÐ°
titleType: Subtitle
title: Conducting an information system security audit and development of measures to counter the detected threats for department of the machine-building enterprise
Creators: name: ÐÐ¼Ð¸Ð½Ð¾Ð²Ð°, ÐÐ»Ð¸Ð·Ð°Ð²ÐµÑÐ°
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2023
Subjects: Ð°ÑÐ´Ð¸Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸
Ð¿Ð¾Ð»Ð¸ÑÐ¸ÐºÐ° Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸
Ð¼ÐµÑÐ¾Ð´Ñ Ð°ÑÑÐµÐ½ÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸
ÑÐµÑÑÑ Ð½Ð° Ð¿ÑÐ¾Ð½Ð¸ÐºÐ½Ð¾Ð²ÐµÐ½Ð¸Ðµ
ÑÐºÑÐ¿Ð»ÑÐ°ÑÐ°ÑÐ¸Ñ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹
security auditing
security policy
authentication methods
penetration tests
exploiting vulnerabilities

description: Ð¢ÐµÐ¼Ð° Ð²ÑÐ¿ÑÑÐºÐ½Ð¾Ð¹ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÑ: Â«ÐÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¸Ðµ Ð°ÑÐ´Ð¸ÑÐ° Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ¸ÑÑÐµÐ¼Ñ Ð¸ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¼ÐµÑ Ð¿ÑÐ¾ÑÐ¸Ð²Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ñ Ð²ÑÑÐ²Ð»ÐµÐ½Ð½ÑÐ¼ ÑÐ³ÑÐ¾Ð·Ð°Ð¼ Ð´Ð»Ñ Ð¿Ð¾Ð´ÑÐ°Ð·Ð´ÐµÐ»ÐµÐ½Ð¸Ñ Ð¼Ð°ÑÐ¸Ð½Ð¾ÑÑÑÐ¾Ð¸ÑÐµÐ»ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐµÐ´Ð¿ÑÐ¸ÑÑÐ¸ÑÂ». Ð ÐºÐ°ÑÐµÑÑÐ²Ðµ Ð¾Ð±ÑÐµÐºÑÐ° Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð²ÑÑÑÑÐ¿Ð°ÐµÑ ÑÐµÐ¼Ð¾Ð½ÑÐ½Ð¾Ðµ Ð¿Ð¾Ð´ÑÐ°Ð·Ð´ÐµÐ»ÐµÐ½Ð¸Ðµ Ð¼Ð°ÑÐ¸Ð½Ð¾ÑÑÑÐ¾Ð¸ÑÐµÐ»ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐµÐ´Ð¿ÑÐ¸ÑÑÐ¸Ñ.Â ÐÐºÑÑÐ°Ð»ÑÐ½Ð¾ÑÑÑ Ð²ÑÐ±ÑÐ°Ð½Ð½Ð¾Ð¹ ÑÐµÐ¼Ð°ÑÐ¸ÐºÐ¸ Ð¾Ð±ÑÑÐ»Ð¾Ð²Ð»ÐµÐ½Ð° Ð¿Ð¾Ð²ÑÐµÐ¼ÐµÑÑÐ½ÑÐ¼ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½ÑÑ ÑÐ¸ÑÑÐµÐ¼, Ð¾Ð³ÑÐ°Ð½Ð¸ÑÐµÐ½Ð½ÑÐ¼ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ Ð°ÑÐ´Ð¸ÑÐ° Ð¸ Ð½Ð¸Ð·ÐºÐ¸Ð¼ ÑÑÐ¾Ð²Ð½ÐµÐ¼ Ð·Ð°ÑÐ¸ÑÐµÐ½Ð½Ð¾ÑÑÐ¸ ÑÐ¸ÑÑÐµÐ¼Ñ Ð² ÑÑÐ´Ðµ Ð¾ÑÐ³Ð°Ð½Ð¸Ð·Ð°ÑÐ¸Ð¹.Ð¦ÐµÐ»Ñ Ð´Ð°Ð½Ð½Ð¾Ð¹ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°ÑÐµÐ»ÑÑÐºÐ¾Ð¹ ÑÐ°Ð±Ð¾ÑÑ â ÑÑÐ¾ Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¸Ðµ Ð°ÑÐ´Ð¸ÑÐ° Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ¸ÑÑÐµÐ¼Ñ, ÑÑÐ½ÐºÑÐ¸Ð¾Ð½Ð¸ÑÑÑÑÐµÐ¹ Ð² Ð¿Ð¾Ð´ÑÐ°Ð·Ð´ÐµÐ»ÐµÐ½Ð¸Ð¸ ÑÐµÐ»ÐµÐ²Ð¾Ð³Ð¾ Ð¿ÑÐµÐ´Ð¿ÑÐ¸ÑÑÐ¸Ñ Ñ ÑÐµÐ»ÑÑ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹, Ð¸ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¼ÐµÑ Ð¿ÑÐ¾ÑÐ¸Ð²Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ñ Ð²ÑÑÐ²Ð»ÐµÐ½Ð½ÑÐ¼ ÑÐ³ÑÐ¾Ð·Ð°Ð¼.Ð Ð¿ÑÐµÐ´ÑÑÐ°Ð²Ð»ÐµÐ½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÐµ Ð¸Ð·Ð»Ð¾Ð¶ÐµÐ½Ð¾ Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¸Ðµ Ð¿ÑÐ¾ÑÐµÐ´ÑÑÑ Ð°ÑÐ´Ð¸ÑÐ° Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ¸ÑÑÐµÐ¼Ñ Ð´Ð»Ñ ÑÐµÐ¼Ð¾Ð½ÑÐ½Ð¾Ð³Ð¾ Ð¿Ð¾Ð´ÑÐ°Ð·Ð´ÐµÐ»ÐµÐ½Ð¸Ñ Ð¼Ð°ÑÐ¸Ð½Ð¾ÑÑÑÐ¾Ð¸ÑÐµÐ»ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐµÐ´Ð¿ÑÐ¸ÑÑÐ¸Ñ. Ð£ÐºÐ°Ð·Ð°Ð½Ð½Ð¾Ðµ Ð¼ÐµÑÐ¾Ð¿ÑÐ¸ÑÑÐ¸Ðµ Ð²ÐºÐ»ÑÑÐ°ÐµÑ Ð² ÑÐµÐ±Ñ:ÑÐ±Ð¾Ñ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¸ Ð¾ ÑÐµÐ»ÐµÐ²Ð¾Ð¹ ÑÐ¸ÑÑÐµÐ¼Ðµ;Ð¿Ð¾Ð¸ÑÐº Ð¸ ÑÐºÑÐ¿Ð»ÑÐ°ÑÐ°ÑÐ¸Ñ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð½ÑÑ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹;ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÑ Ð¸ Ð²Ð½ÐµÐ´ÑÐµÐ½Ð¸Ðµ Ð´Ð¾Ð¿Ð¾Ð»Ð½Ð¸ÑÐµÐ»ÑÐ½ÑÑ Ð¼ÐµÑ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸;Ð½Ð°Ð¿Ð¸ÑÐ°Ð½Ð¸Ðµ Ð¾ÑÑÐµÑÐ°.Ð ÑÐ¾Ð¾ÑÐ²ÐµÑÑÑÐ²Ð¸Ð¸ Ñ ÑÐºÐ°Ð·Ð°Ð½Ð½Ð¾Ð¹ Ð¿Ð¾ÑÐ»ÐµÐ´Ð¾Ð²Ð°ÑÐµÐ»ÑÐ½Ð¾ÑÑÑÑ ÑÑÐ°Ð¿Ð¾Ð², Ð¿ÑÐµÐ´ÑÑÐ°Ð²Ð»ÐµÐ½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ°Ð·Ð´ÐµÐ»ÐµÐ½Ð° Ð½Ð° 6 Ð³Ð»Ð°Ð².ÐÐµÑÐ²Ð°Ñ Ð³Ð»Ð°Ð²Ð° ÑÐ¾Ð´ÐµÑÐ¶Ð¸Ñ Ð°Ð½Ð°Ð»Ð¸Ð· Ð¿ÑÐ¾Ð±Ð»ÐµÐ¼Ñ Ð¸ Ð¾Ð±Ð·Ð¾Ñ Ð»Ð¸ÑÐµÑÐ°ÑÑÑÑ.ÐÑÐ¾ÑÐ°Ñ Ð³Ð»Ð°Ð²Ð° ÑÐ²Ð»ÑÐµÑÑÑ Ð¸Ð·ÑÑÐµÐ½Ð¸ÐµÐ¼ Ð¿Ð¾Ð½ÑÑÐ¸Ð¹ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ¸ÑÑÐµÐ¼Ñ Ð¸ Ð°ÑÐ´Ð¸ÑÐ° Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½ÑÑ ÑÐ¸ÑÑÐµÐ¼.Ð¢ÑÐµÑÑÑ Ð³Ð»Ð°Ð²Ð° â ÑÑÐ¾ ÑÐ±Ð¾Ñ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¸ Ð¾ ÑÐ¸ÑÑÐµÐ¼Ðµ Ð°ÐºÑÐ¸Ð²Ð½ÑÐ¼Ð¸ Ð¸ Ð¿Ð°ÑÑÐ¸Ð²Ð½ÑÐ¼Ð¸ Ð¼ÐµÑÐ¾Ð´Ð°Ð¼Ð¸ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ, Ð° ÑÐ°ÐºÐ¶Ðµ Ð¿Ð¾ÑÑÐµÐ´ÑÑÐ²Ð¾Ð¼ ÑÐºÐ°Ð½Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ.Ð§ÐµÑÐ²ÐµÑÑÐ°Ñ Ð³Ð»Ð°Ð²Ð° Ð¿ÑÐµÐ´ÑÑÐ°Ð²Ð»ÑÐµÑ ÑÐ¾Ð±Ð¾Ð¹ Ð¿Ð¾Ð¸ÑÐº ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð¸ Ð²ÐºÐ»ÑÑÐ°ÐµÑ Ð² ÑÐµÐ±Ñ ÑÐ°Ð±Ð¾ÑÑ ÑÐ¾ ÑÐ¿ÐµÑÐ¸Ð°Ð»ÑÐ½ÑÐ¼ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½ÑÐ¼ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸ÐµÐ¼, Ð½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÐ¼ Ð½Ð° Ð¸Ð·ÑÑÐµÐ½Ð¸Ðµ Ð²Ð½ÑÑÑÐµÐ½Ð½Ð¸Ñ ÑÐ³ÑÐ¾Ð· Ð¿Ð¾ÑÑÐµÐ´ÑÑÐ²Ð¾Ð¼ Ð¿ÑÐ¾Ð½Ð¸ÐºÐ½Ð¾Ð²ÐµÐ½Ð¸Ñ Ð² ÑÐ¸ÑÑÐµÐ¼Ñ.Ð Ð¿ÑÑÐ¾Ð¹ Ð³Ð»Ð°Ð²Ðµ Ð¿ÑÐ¾Ð²Ð¾Ð´Ð¸ÑÑÑ ÑÐºÑÐ¿Ð»ÑÐ°ÑÐ°ÑÐ¸Ñ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð½ÑÑ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹. Ð ÑÐºÐ°Ð·Ð°Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÐµ Ð¿Ð¾Ð¸ÑÐº ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð¾Ð³ÑÐ°Ð½Ð¸ÑÐµÐ½ ÑÐ»ÐµÐ´ÑÑÑÐ¸Ð¼Ð¸ Ð½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸ÑÐ¼Ð¸: Ð²ÐµÐ±-Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ñ, ÑÐ¸ÑÑÐµÐ¼Ð° ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ Ð±Ð°Ð·Ð°Ð¼Ð¸ Ð´Ð°Ð½Ð½ÑÑ, Ð¼ÐµÑÐ¾Ð´Ñ Ð°ÑÑÐµÐ½ÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸.Ð¨ÐµÑÑÐ°Ñ Ð³Ð»Ð°Ð²Ð° Ð¿Ð¾ÑÐ²ÑÑÐµÐ½Ð° ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐµ Ð¼ÐµÑÐ¾Ð¿ÑÐ¸ÑÑÐ¸Ð¹, Ð½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð½Ð° ÑÐ¾ÑÐ¼Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸, Ð¸ Ð²ÐºÐ»ÑÑÐ°ÐµÑ Ð² ÑÐµÐ±Ñ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ Ð¼ÐµÑ Ð¿ÑÐ¾ÑÐ¸Ð²Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ñ ÑÐ³ÑÐ¾Ð·Ð°Ð¼ Ð¸ ÑÐ¾ÑÐ¼Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ Ð´Ð¾Ð¿Ð¾Ð»Ð½Ð¸ÑÐµÐ»ÑÐ½ÑÑ Ð¿ÑÐ°Ð²Ð¸Ð».Ð ÐµÐ·ÑÐ»ÑÑÐ°Ñ ÑÐ°Ð±Ð¾ÑÑ, ÐºÐ¾ÑÐ¾ÑÑÐ¹ Ð¼Ð¾Ð¶ÐµÑ Ð±ÑÑÑ ÑÐµÐºÐ¾Ð¼ÐµÐ½Ð´Ð¾Ð²Ð°Ð½ Ðº Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸Ñ Ð² ÑÐºÐ°Ð·Ð°Ð½Ð½Ð¾Ð¼ Ð¿Ð¾Ð´ÑÐ°Ð·Ð´ÐµÐ»ÐµÐ½Ð¸Ð¸ ÑÐµÐ»ÐµÐ²Ð¾Ð³Ð¾ Ð¿ÑÐµÐ´Ð¿ÑÐ¸ÑÑÐ¸Ñ, Ð¾ÑÐ¾ÑÐ¼Ð»ÑÐµÑÑÑ Ð² Ð²Ð¸Ð´Ðµ Ð¾ÑÑÐµÑÐ° Ð¸ Ð²ÐºÐ»ÑÑÐ°ÐµÑ Ð² ÑÐµÐ±Ñ Ð¾Ð¿Ð¸ÑÐ°Ð½Ð¸Ðµ Ð²ÑÐµÑ Ð¿Ð¾Ð»ÑÑÐµÐ½Ð½ÑÑ Ð² ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹, Ð° ÑÐ°ÐºÐ¶Ðµ ÑÐµÐºÐ¾Ð¼ÐµÐ½Ð´Ð°ÑÐ¸Ð¸.
description: The subject of the graduate qualification work is: âConducting an information system security audit and development of measures to counter the detected threats for department of the machine-building enterpriseâ.Â  The object of the research is repair department of the machine-building enterprise.The relevance of the chosen subject is due to widespread use of information systems, limited use of audit, low level of information system security of organization.The purpose is this research work conducting security audit of information system operation on target enterprise for the detection vulnerabilities and development of measures to counter the detected threats.In the work describes the procedure for auditing the security of an information system for the repair department of a machine-building enterprise.The described procedure includes:collecting information about the target system;search and exploitation vulnerabilities;development and implementation of additional security measures;writing an audit report.In accordance with the specified sequence of stages, the presented work is divided into 6 chapters.The first chapter is an analysis of the problem and a review of the literature.The second chapter is the study of the concepts of information system and information systems security audit.The third chapter is the collection of information about the system by active and passive research methods, as well as by scanning.The fourth chapter is a search for vulnerabilities and includes work with special software aimed at studying internal threats through penetration into the system.In the fifth chapter, the exploitation of the discovered vulnerabilities is carried out. In this work, the search for vulnerabilities is limited to the following areas of activity: web applications, database management system, authentication methods.The sixth chapter is devoted to the development of measures aimed at the formation of security, and includes a study of existing measures to counter threats and the formation of additional rules.The result of the work, which can be recommended for use in the specified division of the target enterprise, is issued in the form of a report and includes a description of all vulnerabilities obtained during the work, as well as recommendations.