Analiza isplativosti uvođenja koncepta mreže nultog povjerenja u tvrtku operatora energetske kritične infrastrukture

professional thesis

• Title (english): Cost-benefit analysis of introducing the zero-trust network concept in critical energy infrastructure operator company
• Author: Goran Kapić
• Mentor: Krešimir Fertalj (mentor)
• Committee member: Boris Vrdoljak (predsjednik povjerenstva)
• Committee member: Krešimir Fertalj (član povjerenstva)
• Committee member: Neven Vrček (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; (Department of Applied Computing); Zagreb
• Defense date and country: 2023-03-27, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Rad obrađuje problematiku promjenjivih i rastućih prijetnji na Internetu u postpandemijskom svijetu i potrebu za novom paradigmom mrežne sigurnosti. Definiraju se osnovni pojmovi organizacije rada, deklariraju korišteni alati, metodologije procjene rizika i korištene metrike, te navode ograničenja i pretpostavke provedenih istraživanja. Pojašnjava se pojam arhitekture nultog povjerenja, utvrđuju njezini osnovni principi i tehnologije, te se projektno definira sigurnosna inicijativa uvođenja ove arhitekture u poslovanje. Dokumentiraju se analize rizika tvrtke prije (početak 2018. godine) i poslije (kraj 2022. godine) uvođenja sigurnosne inicijative, te se razrađuju i analiziraju ukupni troškovi njezinog uvođenja. Uspoređuje se dobiveni pozitivni pomak u profilu rizika tvrtke. Diskutira se opravdanost ulaganja za dobivene koristi kroz analizu troškova i koristi, te se uočavaju okolnosti koje bi takvu sigurnosnu inicijativu mogle učiniti opravdanom.

Abstract (english)

The paper deals with the issue of evolving and escalating threats on the Internet in the postpandemic world and the need for a new paradigm of network security. The basic concepts of work organization are defined, the tools used, risk assessment methodologies and metrics used are declared, and limitations and assumptions of the conducted research are stated. The concept of zero-trust architecture is clarified, its basic principles and technologies are determined, and the security initiative of introducing this architecture into business is defined. Risk analysis of the company before (beginning of 2018.) and after (end of 2022.) the introduction of the security initiative is documented, and the total costs of its introduction are elaborated and analysed. The resulting positive shift in the company's risk profile is analysed. The justification of the investment for the obtained benefits is discussed through the cost-benefit analysis and the circumstances that could make such a security initiative justified are noted.

• Keywords: okvir mrežne sigurnosti; analiza rizika; analiza troška i koristi; mreža nultog povjerenja; ZTA; kibernetička sigurnost
• Keywords (english): network security framework; risk analysis; cost-benefit analysis; zero-trust network; ZTA; cybersecurity
• Language: croatian
• URN:NBN: urn:nbn:hr:168:954314
• Study programme: Title: Specialist study programme in information security; Study programme type: university; Study level: postgraduate specialist; Academic / professional title: Specijalist informacijske sigurnosti (Specijalist informacijske sigurnosti)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Open access
• Created on: 2023-04-18 07:37:18