Experimental Cybersecurity Level Determination in the Civil Aviation Critical Infrastructure

Critical information infrastructure protection is a complex process, which requires effective tools for entities' identification, criticality estimation, threat and vulnerability assessment, as well as security ensuring against threats and determining the cybersecurity level. The conducted analysis has shown that today there is no complex, multifunctional method which helps to evaluate the cybersecurity level of the critical information infrastructure entity or a certain industry of the state. From this viewpoint, in the paper advantages and disadvantages of the known approaches were defined. The authors have previously developed a method for determination the level of cybersecurity in critical information infrastructure of the state. This study was continued by experiments, which tested the adequacy of the method's response to changes in input data. In addition, a special software application was developed and implemented and the developed method was verified. It is proved, that the developed method and software make it possible to calculate quantitative parameters that characterize the security of the analyzed industry, to compare the level of critical object security before and after the security mechanisms implementation.