Digital transformation for chiefs and owners. Volume 3. Cybersecurity. Dzhimsher Chelidze

the fact that we have learned better to detect attacks, but, looking ahead, I will say that even now 70% of the companies studied revealed viruses that were not known. The number of targeted attacks increased from 43% in 2017 to 67% in 2022. And although there were 73% of targeted attacks in 2021, the probability of targeted attacks is high. After all, 2022 is the year of the war in cyberspace, real and large-scale.

      Now about money. The average ransom price that companies pay hackers is also rising. If previously limited to $1—2 thousand, now it is 4.35 million. The same applies to the maximum payout. In 2017, it amounted to $1 million, in 2022 – already more than 40 million.

      The projections are also pessimistic. Therefore, Cybersecurity Ventures expects that the global cost of information attacks will increase by 15% and by 2025 will reach $10.5 trillion per year worldwide, with 6 trillion in 2021 and 3 trillion in 2015.

      I will also give you a graph from PT on how the attacks change, who were attacked more often, and who are now in demand among hackers.

      Here I recommend to pay attention to the financial companies – they are less and less interesting as they become more and more complex for attacks. In general, the market of “civil” hacking is more and more subject to the laws of business: intruders are looking for how to reduce the cost of each attack and increase its profitability. Therefore, hackers are looking for margins. However, this applies only to hackers who do not engage in political orders or targeted attacks, for example, from competitors. As a result, given that there is growth away from mass attacks to targeted ones, it is not necessary to rely on one economic expediency of the attack. If you order, you will be attacked. Especially if you are a Russian company. Additionally, if you are the first person, then it is you under the gun in the first place.

      Chapter 2. On responsibility

      Now the head of the organization is responsible for information security, which is reflected in the decree of the President of the Russian Federation V.V. Putin from 01.05.2022 250. Under its action fall federal executive authorities (federal ministries, services and agencies), management of subjects of the Russian Federation, state funds, state corporations and companies (for example, “Rosatom”, “Gazprom”, “Rushydro”, “RZD” and others) strategic and system-making enterprises, critical infrastructure facilities.

      And while on April 20, 2020 the list of system-forming organizations included 646 legal entities, by July 2020 there were already about 1300, and in February 2022 – about 1400. However, you’d think if you weren’t on that list, why would you want it? It is necessary to understand that in our country, if you plan to grow, you will somehow start working with such organizations. This means that it is better to know the requirements of this document and be prepared. Overall, more than 500,000 organizations will fall under the new decree.

      What is it recommended that organizations do under this decree?

      – Establish personal responsibility for providing IS to the head of the organization, while allocating a separate Deputy General Director, who will have authority and resources to provide IS. It is either necessary to create a structural unit responsible for providing IS or to assign such functions to an existing unit.

      – It is necessary to make an inventory of contracts with contractors providing IS services. Now such services can be provided only by companies that have a license to carry out activities on technical protection of confidential information from FSTEC Russia.

      – Additionally, on March 30, 2022, restrictions were imposed on the acquisition of foreign equipment and software for subjects of critical information infrastructure (KIA), which make purchases for 223-FZ. Since January 1, 2025, organizations are prohibited from using information protection tools produced in unfriendly states, or organizations under their jurisdiction, directly or indirectly controlled by them or affiliated with them. There are 48 such countries in the spring of 2023. And even if the company supplying IS equipment, for example, from China, you still need to check its affiliates.

      Going forward, I’ll make one guess. Taking into account all leaks and the importance of this topic for the state, you can expect the introduction of some insurance, following the example of the CTP. Each organization can be forced to insure against IS-risks. Additionally, then how the organization will build the IS function will influence the size of its premium.

      Chapter 3. About General Trends

      The main trend in the field of IS – professional managers come to the industry. Those who used to be engaged in “technology”, but now have grown up to managers. They think about the technical side of the issue, as well as about money, the processes in the organization, about the responsibility that they take on themselves. Additionally, this is a serious challenge for IS companies. After all, they need to communicate not just with experts who are in the topic, but find a common language with managers. That is to explain primarily in the language of money and guarantees.

      The second trend – the transition from smeared protection throughout the organization, promotion of maturity levels and the use of best practices to a model of guaranteed protection against unacceptable scenarios: disruption of technological cycles, theft of money, confidential information, data encryption. That is, the transition from IS 1.0 to IS 2.0.

      This is because everyone is already aware of the impossibility of protection from everything. First, the growth of digitalization and automation has led to an increase in the number of software used. Which means there’s an exponential increase in the number of attacks. Secondly, as we have said before, all IT solution developers try to reduce costs. For example, even the world IT giant IBM transfers its production to India, because there is cheaper labor programmers. At the same time, the quality of the code from most Indian developers leaves much to be desired. It’s like Chinese replicas of original products. All this leads to a decline in software quality and an increase in the number and criticality of vulnerabilities.

      Additionally, even published “holes” developers do not hurry to eliminate quickly. Here are indicative statistics from PT. Of all vulnerabilities in industrial IT systems identified and sent to developers in 2021, less than half – 47%. In this case, they become known to the world quite quickly – within a few hours.

      In total, about 25,000 new vulnerabilities discovered by security researchers were identified and confirmed in 2022.

      The increase in the number of startups and their programs, as well as the failure to comply with the principles of safe development, can lead to this number being only increased.

      As a result, it turns out that in more than half of the attacks, hackers quietly use these vulnerabilities and get the necessary access in a few minutes. PT specialists themselves, using known vulnerabilities, were able to access the internal network of companies in 60% of their projects. Additionally, now add the fact that there aren’t many white hackers and researchers, and the developers just don’t know about all the holes. Hackers do not seek to publish found vulnerabilities in the public domain. At the same time, the shadow market of hackers itself is on the rise.

      Dynamics of the shadow market

      Third, attacks become targeted rather than mass attacks. As mentioned earlier, it was 43 per cent, now it is 70 per cent.

      Fourth, no matter how advanced the technology, the bottleneck is still people. Therefore, since 2017, the number of people caught on phishing letters, not only has not decreased, but, on the contrary, has increased multiple. Additionally, in the top most used and effective ways to penetrate the company is still phishing via email. In this case, the topics that people open most often remain unchanged from year to year: salary, bonuses, social programs, DMS, resume. In addition, the best mailing lists dedicated to events in a particular company or division. That