The need for information security

This study was conducted using general scientific and specific scientific methods. The object of the article's research is presented, considering the research methodology. Three levels of methodology are generally accepted in legal research: fundamental (philosophical), general scientific, and specific scientific. With the help of the fundamental level of methodology, the most general principles and methods were ensured, which were further specified at the general scientific level.

The formal-logical, historical, system-structural, and generalization methods are worth noting among the general scientific methods used in the study. These methods are fundamental because they can be found in all fields of science and can help operations with the information presented in the research. The levels of information security and types of standards for its provision were identified using the system-structural method (^{Orlovskyi et al., 2018}). The formal-logical method was used to analyze existing information security standards. Lastly, the positions of scientists on the researched problems were systematized and analyzed using the generalization method.

The study also used specific scientific methods, that is, methods specific to legal science, including comparative law, documentary, and statistics. To fully explore the delineated object, it is necessary to use the above methods comprehensively. The comparative legal method was used to analyze the regulatory framework for information security, and the documentary method was used to examine the international and national standards of information security.

The empirical basis of the study was examples of the application of international and national standards for information security by organizations, bodies, and institutions. The normative basis of the study included international regulations, Ukrainian legislation, and international and national standards in information security.

In the context of globalization and informatization, information security is becoming an urgent and critical task for every state. Ukraine is no exception. Even the Constitution of Ukraine (Article 17) states that ensuring information security is the State's most important function, a matter concerning the entire Ukrainian people (^{Constitution of Ukraine, 1996}). In terms of solving this problem in Ukraine, several legal documents exist to firstly determine the general principles of information security and ways to improve it.

For example, the Law of Ukraine On Basic Principles of Information Society Development in Ukraine for 2007-2015 defines the following ways to solve the problem of information security:

It is evident that the State is thorough in defining ways to ensure information security. However, it should be noted that information security as a phenomenon is not static. Just as information and communication technologies do not stand still, the state of protection of vital interests of man, society, and the state is constantly changing. Therefore, even if we can say that the state of information security has been achieved in a specific area at a specific time, it does not mean that this same condition will be maintained in subsequent periods. Information technologies are constantly evolving and improving, leading, among other things, to the emergence of new threats to information security. Therefore, it is necessary to pay attention to information security's instability. In addition, the state of security depends on many factors -both internal and external. The influence of these factors determines the presence or absence of information security.

However, it should be noted that such dynamism, multidimensionality, and uncertainty are not unique to information security. One must agree with the authors of the article, The Negative Impact of Corruption on the Economic Security of States. They rightly note that the threat to economic security is usually considered an undesirable but, at the same time, an integral part of the economic system, which operates in difficult competitive conditions, represented by a multifactorial, dynamic, and uncertain external environment (^{Akimova et al., 2020}). All this indicates that information security standards cannot remain stable for a long time; they must be constantly revised, amended, and the old standards replaced by new ones.

Problems of scientific-theoretical reasoning

^{Kuzmenko (2010)} distinguishes three levels of information security. They are as follows:

These scientists noted that individuals' information security is characterized as a state of protection of the individual, various social groups, and associations of people from influences against their will and desire to change mental states and psychological characteristics, modify behavior, and restrict freedom of choice. State (society) information security is characterized by the degree of protection of the state (society) and the stability of the main spheres of life (economy, science, technosphere, management, and military affairs, among others); relatively dangerous information impacts (including destabilizing, destructive, and affecting state interests.) on the implementation and extraction of information. The State's information security is determined by the ability to neutralize such influences. Organization information security is the purposeful activity of its bodies and officials using permitted forces and means to achieve the organization's information environment's state of security, ensuring its normal functioning and dynamic development (^{Ovsyannikov et al., 2015}).

In this regard, ^{Marushchak (2010)} adds that the problems of scientific and theoretical justification of the feasibility of legal regulation of public relations, arising from the information security of the individual, society, and state, are not only relevant; they are also practical. After all, for example, the regulation of relations on the dissemination of information on the Internet can occur both with the state's participation (both in China) and without legal influence. However, the level of protection of information interests of the state, and in many cases -society and individuals- may differ depending on the presence (absence) of legal regulation. Ensuring the safety of a person is very important in this aspect because an individual's life and health are the highest social value.

Guarantees for human security are a broad concept in which legal aspects are closely intertwined with philosophical, social, and even medical aspects. For example, the authors of the article, Biomedical Ethics and Human Rights in the Context of Innovation and Information Development of Society, note that biomedical ethics is a science of morality, through which human security guarantees are established, and moral and ethical barriers are created, supported by legal acts. The purpose of bioethics is to prevent harm to a person in need of medical care and protect rights and interests (^{Kalyuzhny et al., 2020}; ^{Vakulyk et al., 2020}).

In determining the methods of legal regulation of public information and security relations, the conceptual difference between the principles of information security resources and the security of the state's information space should be considered. ^{Marushchak (2010)} considers these the main objects of information security, the basis of the information sovereignty of Ukraine. To ensure the security of the information space, it is necessary to strictly adhere to the constitutional principles of freedom of speech and the right to information. Meanwhile, to ensure the security of information resources, integrity, accessibility, and completeness of information are among the key aspects. Therefore, the method of legal regulation to ensure the security of information resources should be predominantly imperative, as it mainly concerns the protection of the right to information with limited access, while in ensuring the state's security of information space, it should be dispositive, as it relates to freedom of information, ways to obtain and disseminate information (^{Marushchak, 2010}). In this work, we concede with the scientist's position on the delimitation of areas of regulation of public information and security relations. Indeed, significant restrictions on the rights and freedoms of citizens, especially in ensuring the security of the state's information space, will unlikely solve this problem entirely.

Information security is a component of the country's national security system. Ensuring the society's information security implies the protection of political, social, and economic interests. Given its importance, the international community has long heeded the development and improvement of standards for its provision (^{Chyzhmar et al., 2019}).

Regarding information security standards, it is worth noting that the etymological meaning of the word standard is a norm or sample. On this matter, there is a broad and narrow interpretation of the term in science. In a broad sense, a standard is a particular sample, standard, or model against which other objects are compared and gauged. In the narrow sense, a standard is a normative or technical document that establishes norms, rules, and requirements for an object of standardization. Furthermore, it is worth considering this term's unregulated use in this sphere when analyzing the concept of information security standards.

The first problem that scientists face in studying the legal component of information security is defining information security. At the same time, one of the most controversial issues among scientists concerns information security. They recognize the state's interests in the information sphere and the information rights of citizens and society. However, they only recognize information security in information and telecommunications systems. Given the diversity in composition and content of information security objects, considering the leading scientists' positions on this issue is crucial. An important area of research involves determining the relationship of identical concepts used in current legislation that creates an ambiguous understanding of information security's structure. For example, the concept of information security is defined as the security of devices, processes, programs, environment, and data that ensure the integrity of information processed, stored, and transmitted. Network security is defined as measures to protect local computing networks from unauthorized interference with their functioning or attempts to disrupt the normal operation of its elements. The term Automated System Data Security (AS Data Security) is used to describe the quality of organizing access to data, protecting it from unauthorized use, intentional or unintentional distortion, or destruction. These definitions disagree with the definition of information security and the generic concept of information security of telecommunications networks as the ability of telecommunications networks to protect against destruction, distortion, blocking of information, or unauthorized leakage or violation of its routing (^{Marushchak, 2010}). Unfortunately, this vagueness in terminology can lead to misinterpreting concepts.

Solodka (2013) notes that developed countries have established relations in this area, even before adopting legislation on personal data security. Ensuring proper protection of personal data is provided for in the EU-Ukraine Association Agenda, the EU Visa Liberalization Action Plan for Ukraine, and the draft of the EU-Ukraine Association Agreement. However, the legal institution of personal data in domestic information leg islation is still in its infancy. Even after adopting the Law of Ukraine, On Personal Data Protection, Ukraine's legislation does not establish and, according to some scientists, cannot establish a well-defined list of information about an individual, the data considered personal, and how to apply the Law's provisions to various situations. This is particularly so when processing personal data in information (automated) databases and files of personal data that may arise in the future due to changes in public life. Under national law, personal data is information or a collection of information about an identified individual or one that can be specifically identified (Solodka, 2013). This definition does not improve specificity and may lead to a subjective interpretation in deciding whether a person's right to privacy has been violated.

In this regard, ^{Ovsyannikov et al. (2015)} draw attention in their article to the interests of the state in the information sphere. They include creating conditions for the harmonious development of the state's information infrastructure, implementing constitutional rights and freedoms of man and citizen in the interests of strengthening the constitutional order, upholding the country's sovereignty and territorial integrity, and establishing political and social stability, economic prosperity, unconditional implementation of laws, and support for international cooperation through partnership. The state carries out its activities through the relevant bodies, citizens, and public organizations and associations with the appropriate powers, according to the law. The state system is the most important part of the information security system of the individual, society, and the state. The main tasks of this system include detecting and forecasting destabilizing factors and information threats to the individual, society, and state's vital interests, implementing operational and long-term measures to prevent and eliminate them, and creating and maintaining forces (^{Ovsyannikov et al., 2015}). Thus, State regulation of information security at all levels reflects the state of its provision. Ensuring information security depends on the national measures, whether the information and communication space will be protected, the citizens' security guarantees will be observed, and so on. At the state level, regulations are adopted to regulate this area of public relations.

There is also a position in legal science that maintains that the wording of the right to information and its restrictions (Articles 5, 6 of the Law, On Information, Article 6 of the Law, On Access to Public Information) do not meet international standards. Article 10 of the European Convention states that everyone has the right to freedom of expression. This right includes the freedom to hold opinions and receive and impart information and ideas without interference by public authorities and regardless of frontiers. However, these domestic laws do not address the exercise of the right to information irrespective of state borders; this is relevant in the age of the Internet. Furthermore, laws such as the Law of Ukraine On Information, On State Secrets, On Access to Public Information, On Personal Data Protection, and On Banks and Banking classify some information as closed, setting restrictions on the right of access to information. However, there are conflicts in these laws. For example, in the Law of Ukraine, On Banks and Banking, there is a conflict between the definition of banking secrecy and the list of information attributed to it. It should be noted that no list exists of information that can be classified as a trade secret; this complicates the exercise of a person's right to access information (Solodka, 2013). Thus, it can be stated that the Ukrainian national legislation has some gaps in the field of information security and regulation of public relations that arise in this sphere.

^{Dovhan and Tkachuk (2019)} note that developing and adopting appropriate legislation is necessary to ensure information security. The basic principles of the construction of such a law, as well as information security activities, should firstly include the priority of human and civil rights and freedoms, a principle enshrined in International Law, reflecting the essence and limits of information security activities, and fundamental in the Doctrine of Information Security of Ukraine and observance of human rights and freedoms in the information sphere referring to the primary national interests of our country. The second principle involves the individual, society, and state's balance of interests. It is also provided by the Doctrine of Information Security of Ukraine. It follows the first because the legitimacy of each person's interests extends to the rights and freedoms of others and the interests of society and the state. These rights and freedoms ultimately caused the restrictions associated, for example, with the protection of state secrets and protection of personal data. The third principle, also following the previous principle, is the compliance of security measures with the degree of threats. Measures befitting the threats' actual level should be applied to prevent and eliminate them in the information sphere, with the minimum restrictions on the rights and freedoms of citizens. The fourth involves the state's monopoly on developing and producing special means of informational influence, including informational-psychological influence. In the conditions of Russian aggression, this means the prohibition in Ukraine of specific harmful information and inhumane informational-psychological technologies, which many lawyers rightly call information weapons. The fifth involves transparency and control of civil society in the field of information security. Namely, and following the Law of Ukraine On Access to Public Information, any information on the activities of public administration and local government to ensure information security is open and accessible to citizens unless they constitute a state secret or other secret provided by law. The last principle involves the obligation to involve public organizations in information security activities. This principle, which follows from the previous, and the principle of balanced interests of man, society, and the state, allows for public evaluation of bills related to the information sphere, fully taking into account the interests of various segments of the population to improve the quality of relevant legislation (^{Dovgan & Tkachuk, 2019}). We acquiesce with the opinion of these scientists. Today, Ukraine has an urgent need to consolidate the general principles of information security at the legislative level. However, the development of such legislation should be approached with a clear understanding that information security is a dynamic, multifactorial phenomenon, and predicting how threats and challenges to information security will change in the future is challenging.

In the narrow sense, information security standards are represented by international and national standards of individual countries. Information security requirements to protect information or its properties are defined within the framework of international (ISO standards) and national standards (State Standards of Ukraine and Normative documents of technical information protection). In English standards, this is a classic Systemic-Institutional Alignment (SIA) model for ensuring the requirements of confidentiality, integrity, and availability of information. The requirement of observability (accountability) is made separately. The requirement of confidentiality applies to information; all others apply to both the information and the system as a whole. Three components are also considered for targeted application (protection and prevention mechanism) of information security standards within a certain model in information and telecommunication systems: hardware, software, and communication components (^{Ovsyannikov et al., 2015}).

Organizations and standards to ensure information security

International standards of information security are normative documents developed by the International Organization for Standardization (ISO). The ISO is an independent, non-government organization made up of members from the national standards bodies of 165 countries. Its members play a vital role in how we operate, meeting once a year for a General Assembly that decides our strategic objectives. In Geneva, Switzerland, its Central Secretariat coordinates the system and runs day-to-day operations, overseen by the Secretary-General (International Organization for Standardization, 2021a). The ISO's primary goal was to promote international trade; however, the scope of its activities has expanded significantly with the development of information technology. To this end, this organization has developed the following standards to ensure information security:

These are the main international standards used by world organizations and institutions to ensure information security in their activities.

At the national level, many countries have developed their own information security standards, which are mandatory in a specific area. According to Ukrainian legislation, the standards of other countries may be applied in Ukraine in the prescribed manner by referencing them in national and other standards if their requirements do not contradict the legislation of Ukraine.

It is also possible to apply the official translation of international standards at the national level. For example, there is an identical translation of the relevant international standard in the State Standard DSTU ISO / IEC 27001: 2015 Information technology. Methods of protection. Information security management systems. Requirements. The specified State standard contains, among other things, a broad list of safety measures. These applicable measures include:

According to ^{Ovsyannikov et al. (2015)}, the application of the DSTU ISO/IEC 27001 for banking structures is mandatory and discretionary for structures with other activities. Additionally, harmonization is required with international standards ISO/ IEC 27005: 2008 Information Security Risk Management and ISO/IEC 27003: 2010 Guidelines for the implementation of information security management system to implement the requirements of the information security management system in Ukraine. The first standard provides a framework for determining the approach to risk management depending on the scope of the information security management system, the scope of information security risk management or industry, and the process of information risk assessment, which involves the following two stages: 1) Information risk analysis (identify and quantify assets) - threats, existing means of control, vulnerabilities, and consequences; 2) Information risks assessment - risk management based on an iterative approach to its assessment to obtain an acceptable value. The second standard describes the information security management system's specification and design process from the beginning of the design to the submission of the plans for implementing the system. The purpose of the standard is to provide practical assistance in implementing the information security management system within the organization following ISO/IEC 27001: 2005. The Informatization Department of the National Bank of Ukraine implements the information security management system and risk assessment methodology based on the ISO/ IEC 27003: 2010 standard, Guidelines for implementing the information security management system according to the National Bank of Ukraine's industry standards, considering the peculiarities of banking and requirements of the National Bank of Ukraine on information security (^{Ovsyannikov et al., 2015}). These recommendations indicate that implementing information security management standards cannot be a one-off* action. In fact, it is a continuous process of developing, implementing, operating, monitoring, reviewing, maintaining, and improving the information security management system. The plan - execute - check - act is applied in the modeling processes of the information security management system (^{National Bank of Ukraine, 2011}). These recommendations determine the procedure for preparing the implementation of the information security management system, describing the existing infrastructure and security measures, and proposing risk analysis and assessment in the banking system of Ukraine.

Regarding other branches of management and societal life in general, the legal basis for information security (security of information resources) is contained in a system of documents, including the Constitution of Ukraine; Laws of Ukraine (On Information, On the Protection of Information in Information and Telecommunication Systems, On Basic Principles of Information Society Development in Ukraine, and On Fundamentals of National Security of Ukraine); Presidential and Cabinet of Ministers normative legal acts (National Security Strategy, Doctrine of Information Security of Ukraine, Concept of Technical Protection of Information in Ukraine, and Regulations on Technical Protection of Information in Ukraine); international and state standards defining the relationship between various ministries, agencies, and other Government agencies in terms of information security; and normative documents of the system of technical protection of information and departmental regulations within their responsibility. According to information security standards, an information and telecommunication system is considered protected if it meets the established requirements and guarantees for ensuring the confidentiality, integrity, accessibility, and monitoring of information assets. Undoubtedly, the scientists ^{Ovsyannikov et al. (2015)} are correct in stating that information security is a highly complex problem. Ensuring information security requires a comprehensive approach to security tools development at both the organizational and technical levels and management to provide a mechanism that allows the implementation of information security. Information security management is a part of the general management system whose purpose is to ensure the confidentiality, integrity, and accessibility of information assets (documents, media, applications, information systems, and staff knowledge). It implies implementing the company's security policy on an ongoing basis and its constant updating (^{Ovsyannikov et al., 2015}). The previously mentioned documents primarily define the objects of protection involved in ensuring information security, how to analyze existing threats, challenges, risks, and most importantly, the security measures.

The development and implementation of information security standards are essential for creating a reliable and modern model for protecting personal data and information. Information security standards are designed to minimize risks and threats in the information space locally and internationally.