Information Security Risk Assessment for Personnel During Access Segregation to Company Resources

Abstract

The article addresses the problem of information security risk assessment in the context of the human factor and the specifics of restricting employees’ access to corporate resources. The aim of the study is to improve approaches to assessing information security risks for company personnel during the segregation of access to corporate information resources by developing and implementing a modified sequence of processes that considers the specifics of the human factor and helps minimize threats arising from employees’ mistakes and malicious actions. The object of the research is the process of ensuring information security while managing personnel access to corporate resources. The subject of the research consists in the methods and procedures of information security risk assessment related to personnel activities, as well as the technological sequence of their implementation to minimize threats. The authors emphasize that, on the one hand, company personnel are among its most valuable assets, and on the other hand, they can also be a potential source of threats to information security. Modern approaches to risk assessment are analyzed, including international standards that can serve as a foundation for implementing a comprehensive protection system. It is demonstrated that the key task in protecting information resources is the appropriate definition of roles and categories of personnel, considering their responsibilities and level of accountability. A nine-step sequence is proposed to optimize access segregation, encompassing resource identification and classification, auditing the current security system, proactive risk assessment, formulating recommendations, and implementing new measures. Methods of profiling employees are described, taking into consideration their competencies, behavioral characteristics, and opportunities to access confidential data. Special attention is paid to Role-Based Access Control policies and authentication methods, including password systems and more advanced technologies. The importance of regular auditing and monitoring for timely detection of new threats and vulnerabilities is highlighted. Thus, the application of the developed risk assessment model makes it possible to reduce the number of human errors, enhance the level of business process security, and optimize the management of access to critical resources. The results obtained can be integrated into the company’s information security system to ensure the continuous improvement of protective mechanisms, which positively affects the enterprise’s reputation and minimizes potential financial losses.