Search

Objective. The purpose of the study is to construct an algorithm for the functioning of a software package that automates the process of analyzing and assessing the security of the software used and selecting its most secure version for use at informatization facilities of internal affairs bodies.Method. During the study, we used: a method of a systematic approach to determining software security indicators, a method of mathematical formalization and algorithmization of the process of analyzing and assessing software security for developing program code.Result. An algorithm for the functioning of a software complex is proposed that allows for analysis and quantitative assessment of the security of software of automated systems of internal affairs bodies in relation to current vulnerabilities in real time. The algorithm is complex in nature, including five component algorithms. The operation of the main blocks of the algorithm is described.Conclusion. Conclusions are drawn about the importance of the practical implementation of the developed algorithm in the form of a software package that selects the optimal (most secure) version of software for operation at informatization facilities of internal affairs bodies in order to increase the actual security of limited-distribution official information.

This work presents a methodological approach to comparison of static security code analyzers. It substantiates the comparison of the static analyzers as to efficiency and functionality indicators, which are stipulated in the international regulatory documents. The test data for assessment of static analyzers efficiency is represented by synthetic sets of open-source software, which contain vulnerabilities. We substantiated certain criteria for quality assessment of the static security code analyzers subject to standards NIST SP 500-268 and SATEC. We carried out experiments that allowed us to assess a number of the Russian proprietary software tools and open-source tools. We came to the conclusion that it is of paramount importance to develop Russian regulatory framework for testing software security (firstly, for controlling undocumented features) and evaluating the quality of static security code analyzers.

The authors describes a new technique of binary code decompilation and its application possibility in information security such as software protection against reverse engineering and code obfuscation analyze in malware.