# Educational Organization's Security Level Estimation Model
## 1 Introduction  
The increasing popularity of information technologies brings new features to its users, however, at the same time additional cybersecurity risks appear. The report published by Skybox Security in 2021 shows that the vulnerabilities and threats on the Internet have increased 106% from 2019 to 2020 [1]. This is partly related to the COVID-19 pandemic and global quarantine when most of the daily activities moved to cyberspace. The transition had to be performed quickly, therefore, in some cases, not enough attention was dedicated to the security issues. One of the areas significantly changed during the pandemic is education. The education process was transformed into e-learning. The fast changes in the pandemic situation did not allow long preparation; therefore, the transition from traditional to e-learning mostly was conducted by experimenting, rather than deeply analyzing the situation andthe possible security risks to the educational organization and its user. However, security management in educational organizations is related not only to the pandemic--most of the education organizations have not enough resources and/or knowledge to evaluate the security risks and manage them. The lack of security experts or/and their attention in education organizations lead to the need for security level estimation models adapted to non-security expert usage. The model would allow estimation on how the security level would change by incorporating new systems into the learning process, defining its availability, how organization security and its information technology infrastructure management policies might affect the security level, etc. Existing security risk evaluation solutions are mostly based on an expert's opinion and analysis of the specific situation and are, therefore, a time, resource, and knowledge consuming task. Therefore, the paper aims to simplify the security level estimation process for education organizations by presenting a quantitative security level estimation model. Our supposition is that the model usage requires no security experts' knowledge and actions in educational organization security level estimation while it provides a quantitative security level score, similar to experts' security level evaluation results. The obtained score could be used for the organization's security level modeling, comparison of several alternative situations in the sense of security level assurance. Therefore, a simpler modeling of security level in an educational organization would lead to better situation understanding and a security level increase. The educational organization specifics are the variety of stakeholders (employees, students of different ages, students' parents), dedicated purpose information systems usage (learning material and knowledge evaluation tools, communication systems), orientation on two-directional services (teachers provide a teaching service, not based on students order but existing governmental requirements, while the students are obliged to demonstrate learning results to the teacher) and other. Existing security risk evaluation methods can be used to assess the educational organization security level; however, all these specifics must be taken into account. Therefore, a deep and time-consuming analysis must be performed and the final decision must be taken by a security management expert. By using the proposed model, the security level estimation would not require security risk evaluation expertise as the criteria importance coefficients are obtained in this research; therefore, even information technology knowledge would be enough to model and investigate possible security levels. It would require model input data gathering, while the security level metric would be provided as an output with no need to evaluate security risk or impact to the organization. To achieve the aim, the paper overviews the related works in Section 2 for the reveal of existing models and possible implementation solutions.