# Cyber Security Risk Modeling in Distributed Information Systems
## 2 Literature Review and Problem Statement
### Distributed Information Systems Overview  
According to [PERSON], there is no generally accepted and strict definition of a distributed system [26; 27; 28] The key parameter defining a distributed system is the separation of its functions among several computers. With this approach, distributed IS are geographically spread systems consisting of interacting computers and terminals connected by data transmission channels. A distributed system is much larger and more powerful than typical centralized systems due to the combined capabilities of distributed components. Examples of distributed systems include computer networks, distributed databases, real-time process control systems, and distributed information processing systems. Key characteristics of distributed systems are as follows. Resource sharing  
Openness  
Transparency  
Concurrency  
Scalability  
High performance  
Reliability  
Fault Tolerance  
At the same time, distributed systems have some disadvantages and weaknesses. Increased system response time  
Difficulty controlling remote elements  
Difficulty to develop, debug and use  
Additional efforts to ensure information security  
Such systems are characterized by functioning under random factors, negative influences of various natures, active interaction with the external environment, and costly consequences of possible violations or errors in work. The organization of cybersecurity risk assessment in distributed systems involves solving a set of problems related to functional distribution and hierarchy, a high degree of parallelization of resources, and an almost complete absence of centralized management. Thus, the scientific and applied task of studying cybersecurity risk assessment models in DIS is relevant today and requires in-depth research. Examples of practical implementation of distributed information systems in agriculture, energy, and financial sectors are described in many studies by Ukrainian researchers, e.g., [PERSON], [PERSON], [PERSON] et al. [29; 30; 31]. In [29], software was developed for a distributed information system for diagnosing the quality of electricity consumers using cloud technologies. The synchrophasor technology (ST) used is usually the use of input from the synchrophasor PMU for monitoring. Energy facilities are vulnerable to various cyber attacks, moreover, they often represent critical infrastructure. According to statistics, in just one month of 2021 in Ukraine, 19% of industrial systems were subjected to various types of attacks. Threats were primarily associated with network attacks and attacks on user workstations. In 2016, a successful attack was carried out on the Severnaya substation, then the entire control system went out of order and most of Kyiv was de-energized [33]. The most dangerous are attacks on nuclear facilities, including nuclear power plants. In2009, the Stuxnet worm got into the network of one of the Iranian nuclear plants through a flash memory and modified the control software so that the calibrating program failed and the centrifuge went into resonance and went out of order, thus sabotaging the entire nuclear program [33]. Distributed intelligent information systems include multi-agent robotic systems described in studies by Russian [34; 35; 36], Ukrainian [37; 38], and Malay [39] researchers. Robotic systems have their own information security risks. Nearly 50 vulnerabilities have been discovered in the code of industrial robots and cobots. These vulnerabilities can be used to harm employees or for espionage. The units can be controlled remotely by changing the configuration, for example, especially in the case of an installed camera and microphone. At the same time, industrial espionage and changing security settings are possible, allowing cobots to leave restricted areas and turn off sensors that might be turned off when it comes into contact with people. Most modern technologies are connected via the Internet and can be controlled via phone. Therefore, they are easy to hack.