МЕМЛЕКЕТТІК ОРГАНДАРДЫҢ БҰЛТТЫ СЕРВИСТЕРІНДЕГІ АҚПАРАТТЫҚ ҚАУІПСІЗДІК: ТӘУЕКЕЛДЕРДІ БАҒАЛАУ ЖӘНЕ ҚОРҒАУ СТРАТЕГИЯЛАРЫ

Abstract

This article examines information security issues in cloud services of government bodies, risk assessment methods, and protection strategies. The relevance of this topic stems from the dichotomous conflict between economic efficiency and strict regulatory security requirements for government information resources within the three-tier cloud computing model—SaaS (software as a service), PaaS (platform as a service), and IaaS (infrastructure as a service)—as the primary factor determining the scientific and educational value of research. The integration of public sector entities into cloud computing infrastructure is considered a strategic priority for the purpose of optimizing operational costs associated with the use of information and communications technologies and increasing the functional efficiency of e-government institutions. However, this process creates new risks and threats to data confidentiality, integrity, and availability. The study analyzes five main classes of cyber threats in cloud services (traditional attacks, functional attacks, client–side attacks, virtualization threats, complex threats). Modern methods of protecting virtual infrastructure (hypervisor protection, virtual machine migration control, management system protection) are described. Prospective cloud security technologies – self–protected data and trusted monitors – are considered. The relevance of the study is confirmed by the increasing frequency of targeted cyberattacks on cloud infrastructures and the lack of unified risk assessment methodologies for hybrid environments that take into account national specifics. The object of the research is cloud services within the government administration perimeter, and the subject is the methodology for assessing risk factors and approaches to creating a multi–level security architecture. The aim of the work is to develop an adaptive risk assessment model and formulate practical protection strategies for government cloud platforms.