Assessment of the risks of personal data leakage from through supplier channel attacks

Abstract

Objective. The problem of personal data (PD) protection continues to be relevant even despite the more than significant amount of regulatory documentation developed by various regulators. The aim of the study is to develop methods for assessing the risk of personal data leakage from malicious attacks through supplier channels.

Method. The presented paper examines the problem of protecting personal data in information systems of universities through third–party channels – service providers (supply chain attack), which, in most cases, have not been sufficiently studied by experts in the field of IT-security.

Result. Unlike the well-known "commercial" proposals providing for the introduction of new and new countermeasures (limited only by the budget), it is proposed to apply the method of assessing the risks of PD leakage through all existing PD circulation channels, and not only for the simplest formalized fulfillment of the requirements of the PD owner. The focus of the presented work is on ensuring the protection of PD for Universities in the Russian Federation, accordingly, several channels for the dissemination of PD in the main critical areas (provision of educational content, data of applicants and their representatives, requests from employers, etc.) were studied.

Conclusion. The presented results can be in demand both in the educational process for University programs in the specialty "Information Security", and by experts dealing with practical aspects of ensuring the protection of PD in Universities.