# Cyber Security Risk Modeling in Distributed Information Systems
## 4 Materials and Methods
### Development of Assessment Methodology  
To make the right and balanced decision, information system risks must be correctly identified and assessed in terms of the damage they can cause and the probability of their occurrence. The loss analysis determines the degree of risk impact on the company's IT assets and the business processes they support. The assessment may be based on the identification and analysis of vulnerabilities inherent in IT assets and threats that can be implemented through the exploitation of these vulnerabilities. Thus, risk assessment includes the identification of assets, vulnerabilities, threats, their probabilities, and consequences. The developed assessment methodology is presented as a diagram in Figure 6.  
A threat and vulnerability assessment must be performed for each network asset. Threat identification (Figure 6, block 1) is a process of finding all the factors that can damage the assets of the organization. Threats can be accidental or intentional in nature and have a natural or human origin. After identifying the source of the threat and the objects to which it applies, it is necessary to assess its probability on a quantitative or qualitative scale (high, medium, or low probability) [68; 69; 70; 71]. Within the proposed approach threat assessment is performed using the Classification Decision Tree algorithm (Figure 6, block A) and correlated to the global knowledge base of adversary tactics, techniques, and procedures--MITRE ATT&CK Matrix (Figure 6, block B). \[T=f_{1}(x_{1},x_{2},\ldots x_{n}), \tag{1}\]  
where \(x_{i}\)--distributed metadata and metrics of the information system, \(i\) = 1, and n--Subpected Threat Number. Identification of vulnerabilities (Figure 6, block 3) includes the identification of weaknesses in the protection system that can be used by the source of threat to damage assets. Vulnerabilities can be both technical (hardware, software, system configuration, communication equipment, physical environment, etc.) and organizational (management; personnel, business processes, and procedures). The vulnerability itself does not cause harm, as it requires a threat that can exploit it. The result of this step should be a list of vulnerabilities with an assessment of the ease of use of each vulnerability on a quantitative or qualitative scale. Figure 6: Risk assessment methodology. The \"Vulnerabilities\" metric is used to assess vulnerabilities within the proposed approach. It shows the number of vulnerabilities found for a given network asset. The information is retrieved from the QRadar Vulnerability Manager (Figure 6, block E) and generated based on the results of the OpenVAS scanner (Open Vulnerability Assessment System). \[V=f_{2}(x_{v}), \tag{2}\]  
where \(x_{v}\)--\"Vulnerabilities\" metric. Asset identification (Figure 6, block 2) is a process related to the inventory of all resources of the organization, the determination of the value of these assets, and the assessment of their impact. At this step, the assets are classified by priority in terms of their importance for the company's business objectives and the cost of recovery. At the stage of asset valuation, it is necessary to normalize the structure of the network and select the most important segments with a greater weight coefficient (where the level of potential losses (Figure 6, block D) during threat implementation is higher).