The problem of multi-criteria selection of network security configurations (NSC) under resource constraints and the necessity to comply with information security (IS) policies is addressed in this study. A formal mathematical model of the problem has been developed, encompassing the definition of a set of possible security mechanism configurations, the formalization of objective functions reflecting security levels, throughput, and deployment costs, and the introduction of constraints on feasible solutions. The NSGA-II (Non-dominated Sorting Genetic Algorithm II) optimization algorithm is employed to generate a set of Pareto-optimal solutions, ensuring uniform coverage of compromise configurations. A software package implemented in Python 3 incorporates modules for population generation, fitness evaluation, selection, crossover, mutation operators, and result visualization. Computational experiments (CE) were conducted to validate the effectiveness of the proposed approach. The evolution dynamics of the Pareto hypervolume were analyzed, the uniformity of solution distribution in the objective space was studied, and the impact of algorithm parameters on convergence to the optimal solution was examined. The results demonstrate that the proposed methodology enables the formation of NSC sets that achieve a balanced trade-off between security, throughput, and IS system deployment costs.

The coming era of quantum supremacy has created an existential threat to critical information infrastructures (CIIs). This threat is realized through delayed attack vectors of the “Harvest Now, Decrypt Later” (HNDL) class. Existing security paradigms dictate forced migration to post-quantum cryptography (PQC) algorithms. However, in the context of legacy architectures, and in particular in the ICS and SCADA segments, such a strategy generates quantum technological friction. This friction can trigger cascading failures of legitimate CII services. This article proposes addressing the PQC transformation problem not as a linear IT modernization task, but as a general-sum differential Stackelberg game. The concept of “active deception” (Cyber Deception) is described as a Leader (Defender) strategy, i.e., the variable redistribution of budgets between real cryptographic migration and the generation of resource-intensive decoy infrastructures. Using the Forward-Backward Sweep Method algorithm, optimal software controls are obtained for three typical architectural profiles, calibrated using statistical data from the critical information infrastructure of the Republic of Kazakhstan. Numerical simulations have demonstrated that in high-inertia and strategic networks, maximizing active deception creates the necessary “temporal buffer”, minimizing the damage from an HNDL compromise while maintaining operational continuity. The results support the need to revise rigid cryptographic transition regulations in favor of flexible, mathematically sound hybrid strategies.