home > Computer > Fundamentals of information security. Ensuring information security Organization of data security and information protection

Fundamentals of information security. Ensuring information security Organization of data security and information protection

Rapidly developing computer information technologies are making noticeable changes in our lives. Information has become a commodity that can be bought, sold, exchanged. At the same time, the cost of information is often hundreds of times greater than the cost of the computer system in which it is stored.

From the degree of security information technologies the well-being and sometimes even the lives of many people depend on it. Such is the payment for the complication and ubiquity of automated information processing systems.

Under information security refers to the security of an information system from accidental or intentional interference that harms the owners or users of information.

In practice, three aspects of information security are the most important:

availability(possibility to receive the required information service within a reasonable time);
integrity(relevance and consistency of information, its protection from destruction and unauthorized changes);
confidentiality(protection against unauthorized reading).

Violations of the availability, integrity and confidentiality of information can be caused by various dangerous effects on information computer systems.

The main threats to information security

A modern information system is a complex system consisting of a large number of components of varying degrees of autonomy that are interconnected and exchange data. Almost every component can be exposed to external influences or fail. The components of an automated information system can be divided into the following groups:

hardware- computers and their components (processors, monitors, terminals, peripheral devices - disk drives, printers, controllers, cables, communication lines, etc.);
software- purchased programs, source, object, boot modules; operating systems and system programs (compilers, linkers, etc.), utilities, diagnostic programs etc.;
data- stored temporarily and permanently, on magnetic media, printed, archives, system logs, etc.;
staff- service personnel and users.

Hazardous impacts on a computer information system can be divided into accidental and intentional. Analysis of experience in design, manufacture and operation information systems shows that information is subjected to various random influences at all stages of the system life cycle. Causes random influences during operation can be:

emergencies due to natural disasters and power outages;
equipment failures and failures;
software bugs;
errors in the work of personnel;
interference in communication lines due to environmental influences.

Intentional Impacts- These are targeted actions of the offender. An employee, a visitor, a competitor, a mercenary can act as an intruder. The actions of the violator may be due to various motives:

employee's dissatisfaction with his career;
a bribe;
curiosity;
competitive struggle;
striving for self-assertion at any cost.

You can make a hypothetical model of a potential intruder:

qualification of the violator at the level of the developer of this system;
the violator can be both an outsider and a legitimate user of the system;
the violator knows the information about the principles of the system;
the offender chooses the weakest link in the defense.

The most common and diverse type of computer violations is unauthorized access(NSD). NSD uses any error in the protection system and is possible with an irrational choice of protection tools, their incorrect installation and configuration.

Let's classify the UA channels, through which it is possible to carry out the theft, change or destruction of information:

Through a person:
- theft of storage media;
- reading information from the screen or keyboard;
- reading information from a printout.
Through the program:
- interception of passwords;
- decryption of encrypted information;
- copying information from media.
Through hardware:
- connection of specially designed hardware providing access to information;
- interception of spurious electromagnetic radiation from equipment, communication lines, power supply networks, etc.

Particular attention should be paid to the threats to which computer networks may be exposed. The main feature of any computer network is that its components are distributed in space. Communication between network nodes is carried out physically using network lines and programmatically using the message mechanism. In this case, control messages and data sent between network nodes are transmitted in the form of exchange packets. Computer networks are characterized by the fact that so-called remote attacks. An intruder can be located thousands of kilometers from the attacked object, and not only a specific computer, but also information transmitted over network communication channels can be attacked.

Ensuring information security

The formation of an information security regime is a complex problem. Measures to address it can be divided into five levels:

legislative (laws, regulations, standards, etc.);
moral and ethical (all kinds of norms of behavior, non-compliance with which leads to a drop in the prestige of a particular person or an entire organization);
administrative (general actions taken by the management of the organization);
physical (mechanical, electro- and electronic-mechanical obstacles on possible ways penetration of potential intruders);
hardware and software (electronic devices and special information security programs).

A single set of all these measures aimed at countering security threats in order to minimize the possibility of damage form protection system.

A reliable protection system must comply with the following principles:

The cost of protective equipment should be less than the amount of possible damage.
Each user must have the minimum set of privileges required to work.
Protection is the more effective, the easier it is for the user to work with it.
Possibility of switching off in case of emergency.
Specialists related to the protection system must fully understand the principles of its functioning and, in case of difficult situations, adequately respond to them.
The entire information processing system must be protected.
The developers of the protection system should not be among those whom this system will control.
The protection system must provide evidence of the correctness of its work.
Persons involved in ensuring information security should be personally responsible.
It is expedient to divide protected objects into groups so that violation of protection in one of the groups does not affect the security of others.
A reliable protection system must be fully tested and agreed upon.
Protection becomes more efficient and flexible if it allows the administrator to change its settings.
The security system should be designed with the assumption that users will make serious mistakes and generally have the worst of intentions.
The most important and critical decisions must be made by a human.
The existence of security mechanisms should be kept as hidden as possible from the users whose work is under control.

Hardware and software information security

Despite the fact that modern operating systems for personal computers, such as Windows 2000, Windows XP and Windows NT, have their own protection subsystems, the relevance of creating additional protection tools remains. The fact is that most systems are not able to protect data that is outside of them, for example, during network information exchange.

Hardware and software information security tools can be divided into five groups:

Systems of identification (recognition) and authentication (authentication) of users.
Disk data encryption systems.
Encryption systems for data transmitted over networks.
Electronic data authentication systems.
Cryptographic key management tools.

1. User identification and authentication systems

They are used to restrict access of random and illegal users to the resources of a computer system. The general algorithm of such systems is to obtain from the user information proving his identity, verify its authenticity and then provide (or not provide) this user with the ability to work with the system.

When building these systems, the problem of choosing information arises, on the basis of which the procedures for identifying and authenticating the user are carried out. The following types can be distinguished:

secret information that the user has (password, secret key, personal identifier, etc.); the user must remember this information or special storage facilities can be used for it;
physiological parameters of a person (fingerprints, drawing of the iris, etc.) or behavioral characteristics (features of working on the keyboard, etc.).

Systems based on the first type of information are considered traditional. Systems that use the second type of information are called biometric. It should be noted the emerging trend of advanced development of biometric identification systems.

2. Disk data encryption systems

To render information useless to the adversary, a set of data transformation methods is used, called cryptography[from Greek. cryptos- hidden and grapho- writing].

Encryption systems can perform cryptographic transformations of data at the file level or at the disk level. The programs of the first type include archivers such as ARJ and RAR, which allow the use of cryptographic methods to protect archive files. An example of a second type of system is the Diskreet encryption program, which is part of the popular Norton Utilities software package, Best Crypt.

Another classification feature of disk data encryption systems is the way they operate. According to the method of functioning, the disk data encryption system is divided into two classes:

"transparent" encryption systems;
systems specifically called in to perform encryption.

In transparent encryption systems (on-the-fly encryption), cryptographic transformations are carried out in real time, imperceptibly to the user. For example, a user writes a document prepared in a text editor to a protected disk, and the protection system encrypts it during the writing process.

Second-class systems are usually utilities that need to be specifically invoked to perform encryption. These include, for example, archivers with built-in password protection.

Most systems that offer to set a password for a document do not encrypt the information, but only provide a password request when accessing the document. These systems include MS Office, 1C and many others.

3. Encryption systems for data transmitted over networks

There are two main encryption methods: channel encryption and terminal (subscriber) encryption.

When channel encryption all information transmitted over a communication channel, including service information, is protected. This encryption method has the following advantage - embedding encryption procedures at the link layer allows the use of hardware, which improves system performance. However, this approach also has significant drawbacks:

service data encryption complicates the network packet routing mechanism and requires data decryption in intermediate communication devices (gateways, repeaters, etc.);
Encryption of service information can lead to the appearance of statistical patterns in encrypted data, which affects the reliability of protection and imposes restrictions on the use of cryptographic algorithms.

End-to-end (subscriber) encryption allows you to ensure the confidentiality of data transmitted between two subscribers. In this case, only the content of messages is protected, all service information remains open. The disadvantage is the ability to analyze information about the structure of the message exchange, such as the sender and recipient, the time and conditions of data transmission, as well as the amount of data transmitted.

4. Electronic data authentication systems

When exchanging data over networks, the problem arises of authenticating the author of the document and the document itself, i.e. establishing the author's identity and checking the absence of changes in the received document. For data authentication, a message authentication code (imitation insertion) or an electronic signature is used.

Imitation insert is generated from open data by means of a special encryption transformation using a secret key and transmitted over a communication channel at the end of the encrypted data. The spoof insertion is verified by the receiver, who owns the secret key, by repeating the procedure previously performed by the sender on the received public data.

Electronic digital signature represents a relatively small amount of additional authentication information transmitted along with the signed text. The sender generates a digital signature using the sender's private key. The recipient verifies the signature using the sender's public key.

Thus, the principles of symmetric encryption are used to implement imitation insertion, and asymmetric encryption is used to implement an electronic signature. We will study these two encryption systems in more detail later.

5. Cryptographic Key Management Tools

The security of any cryptosystem is determined by the cryptographic keys used. In the case of weak key management, an attacker can get hold of key information and gain complete access to all information on a system or network.

There are the following types of key management functions: generation, storage, and distribution of keys.

Ways key generation for symmetric and asymmetric cryptosystems are different. To generate keys of symmetric cryptosystems, hardware and software generation tools are used. random numbers. Key generation for asymmetric cryptosystems is more difficult, since the keys must have certain mathematical properties. We will dwell on this issue in more detail when studying symmetric and asymmetric cryptosystems.

Function storage involves the organization of secure storage, accounting and deletion of key information. To ensure the secure storage of keys, they are encrypted using other keys. This approach leads to the concept of a key hierarchy. The key hierarchy typically includes a master key (i.e., a master key), a key encryption key, and a data encryption key. It should be noted that the generation and storage of the master key is a critical cryptographic issue.

Distribution- the most responsible process in key management. This process must ensure that the keys to be distributed are kept secret and must be prompt and accurate. Keys are distributed between network users in two ways:

using a direct exchange of session keys;
using one or more key distribution centers.

List of documents

ABOUT THE STATE SECRET. Law of the Russian Federation of July 21, 1993 No. 5485-1 (as amended federal law dated October 6, 1997 No. 131-FZ).
ABOUT INFORMATION, INFORMATIZATION AND PROTECTION OF INFORMATION. Federal Law of the Russian Federation of February 20, 1995 No. 24-FZ. Adopted by the State Duma on January 25, 1995.
ON LEGAL PROTECTION OF PROGRAMS FOR ELECTRONIC COMPUTERS AND DATABASES. Law of the Russian Federation of February 23, 1992 No. 3524-1.
ABOUT ELECTRONIC DIGITAL SIGNATURE. Federal Law of the Russian Federation of January 10, 2002 No. 1-FZ.
ABOUT COPYRIGHT AND RELATED RIGHTS. Law of the Russian Federation of July 9, 1993 No. 5351-1.
ABOUT THE FEDERAL BODIES OF GOVERNMENT COMMUNICATIONS AND INFORMATION. Law of the Russian Federation (as amended by Decree of the President of the Russian Federation of December 24, 1993 No. 2288; Federal Law of November 7, 2000 No. 135-FZ.
Regulations on the accreditation of testing laboratories and certification bodies of information security tools for information security requirements / State Technical Commission under the President of the Russian Federation.
Instructions on the procedure for marking certificates of conformity, their copies and certification information security equipment / State Technical Commission under the President of the Russian Federation.
Regulations on the certification of informatization objects for information security requirements / State Technical Commission under the President of the Russian Federation.
Regulations on the certification of information security tools for information security requirements: with additions in accordance with Decree of the Government of the Russian Federation of June 26, 1995 No. 608 "On certification of information security tools" / State Technical Commission under the President of the Russian Federation.
Regulations on state licensing of activities in the field of information security / State Technical Commission under the President of the Russian Federation.
Automated systems. Protection against unauthorized access to information. Classification of automated systems and information security requirements: Guiding document / State Technical Commission under the President of the Russian Federation.
Money protection concept computer science and automated systems from unauthorized access to information: Guidance document / State Technical Commission under the President of the Russian Federation.
Computer facilities. Firewalls. Protection against unauthorized access to information. Indicators of security against unauthorized access to information: Guidance document / State Technical Commission under the President of the Russian Federation.
Computer facilities. Protection against unauthorized access to information. Indicators of security against unauthorized access to information: Guidance document / State Technical Commission under the President of the Russian Federation.
Data protection. Special security marks. Classification and general requirements: Guiding document / State Technical Commission under the President of the Russian Federation.
Protection against unauthorized access to information. Terms and definitions: Guiding document / State Technical Commission under the President of the Russian Federation.

Confidential information is of great interest to competing firms. It is she who becomes the cause of encroachment by intruders.

Many problems are associated with underestimation of the importance of the threat, as a result of which this can lead to collapse and bankruptcy for the enterprise. Even a single case of negligence of the working staff can bring the company multimillion-dollar losses and loss of customer confidence.

Threats expose data on the composition, status and activities of the company. The sources of such threats are its competitors, corrupt officials and criminals. Of particular value to them is familiarization with protected information, as well as its modification in order to cause financial damage.

Even 20% leakage of information can lead to such an outcome. Sometimes the loss of company secrets can happen by accident, due to the inexperience of the staff, or due to the lack of security systems.

For information that is the property of the enterprise, there may be threats of the following types.

Threats to the confidentiality of information and programs. May occur after illegal access to data, communication channels or programs. Containing or sent data from a computer can be intercepted through leak channels.

For this, special equipment is used that analyzes the electromagnetic radiation received while working on a computer.

Risk of damage. Illegal actions of hackers can lead to routing distortion or loss of transmitted information.

Availability threat. Such situations prevent a legitimate user from using services and resources. This happens after they are captured, data is received on them, or lines are blocked by intruders. Such an incident may distort the reliability and timeliness of the transmitted information.

There are three important conditions that will allow a Russian citizen: an ideal business plan, a well-thought-out accounting and personnel policy, and the availability of free funds.
Preparation of documents for opening an LLC requires a certain amount of time. It takes about 1-2 days to open a bank account. Read more about the documents required to open an LLC here.

The risk of refusal to execute transactions. Refusal of the user from the information transmitted by him in order to avoid liability.

internal threats. Such threats are of great danger to the enterprise. They come from inexperienced managers, incompetent or unqualified personnel.

Sometimes employees of an enterprise can deliberately provoke an internal leak of information, thus showing their dissatisfaction with their salary, work or colleagues. They can easily present all the valuable information of the enterprise to its competitors, try to destroy it, or deliberately introduce a virus into computers.

Ensuring information security of the enterprise

The most important accounting processes are automated by the corresponding class of systems, the security of which is achieved by a whole range of technical and organizational measures.

They include an anti-virus system, protection of firewalls and electromagnetic radiation. The systems protect information on electronic media, data transmitted over communication channels, restrict access to diverse documents, create backup copies and restore confidential information after damage.

A full-fledged provision of information security in an enterprise should be and be under full control year-round, in real time around the clock. The system takes into account all life cycle information, from the moment it appears to its complete destruction or loss of significance for the enterprise.

For safety and to prevent data loss in the information security industry, protection systems are being developed. Their work is based on complex software systems with a wide range of options that prevent any data loss.

The specificity of the programs is that for their proper functioning, a legible and well-oiled model of the internal circulation of data and documents is required. Security analysis of all steps when using information is based on working with databases.

Ensuring information security can be carried out using online tools, as well as products and solutions offered on various Internet resources.

The developers of some of these services have managed to correctly compose an information security system that protects against external and internal threats, while providing an ideal balance of price and functionality. The proposed flexible modular complexes combine the work of hardware and software.

Kinds

The logic of functioning of information security systems involves the following actions.

Predicting and quickly recognizing threats to data security, motives and conditions that contributed to damage to the enterprise and caused failures in its work and development.

Creating such working conditions under which the level of danger and the likelihood of damage to the enterprise are minimized.

Compensation for damages and minimization of the impact of identified damage attempts.

Information security tools can be:

technical;
software;
cryptographic;
organizational;
legislative.

Organization of information security at the enterprise

All entrepreneurs always strive to ensure the availability of information and confidentiality. To develop suitable information protection, the nature of possible threats, as well as the forms and methods of their occurrence, are taken into account.

The organization of information security in the enterprise is carried out in such a way that a hacker can face many levels of protection. As a result, the attacker is unable to penetrate the protected part.

The most effective way to protect information is a cryptographically strong encryption algorithm during data transmission. The system encrypts the information itself, and not just access to it, which is also relevant for.

The structure of access to information should be multi-level, in connection with which only selected employees are allowed to access it. The right of full access to the entire volume of information should have only trustworthy persons.

The list of information relating to information of a confidential nature is approved by the head of the enterprise. Any violations in this area should be punished by certain sanctions.

Protection models are provided for by the relevant GOSTs and are standardized by a number of comprehensive measures. Currently developed special utilities, monitoring the network status around the clock and any warnings of information security systems.

Keep in mind that low-cost wireless networks cannot provide required level protection.

To avoid accidental loss of data due to inexperienced employees, administrators should conduct training sessions. This allows the enterprise to monitor the readiness of employees for work and gives managers confidence that all employees are able to comply with information security measures.

atmosphere of a market economy and high level competition forces company leaders to always be on the alert and quickly respond to any difficulties. Over the past 20 years, information technology has been able to enter all areas of development, management and business.

From the real world, business has long turned into a virtual one, just remember how they became popular, which has its own laws. Currently, virtual threats to the information security of an enterprise can inflict enormous real harm on it. By underestimating the problem, leaders risk their business, reputation, and credibility.

Most businesses regularly suffer losses due to data breaches. The protection of enterprise information should be a priority in the development and operation of a business. Ensuring information security is the key to success, profit and achievement of the company's goals.

Information Security Policy.

1. General provisions

This Information Security Policy ( Further - Policy ) defines a system of views on the problem of ensuring information security and is a systematic presentation of the goals and objectives, as well as organizational, technological and procedural aspects of ensuring the security of information of information infrastructure objects, including a set of information centers, databanks and communication systems of the organization. This Policy has been developed taking into account the requirements of the current legislation of the Russian Federation and the immediate prospects for the development of information infrastructure facilities, as well as the characteristics and capabilities of modern organizational and technical methods and hardware and software information protection.

The main provisions and requirements of the Policy apply to all structural divisions of the organization.

The policy is a methodological basis for the formation and implementation of a unified policy in the field of ensuring the security of information of information infrastructure objects, the adoption of agreed management decisions and development of practical measures aimed at ensuring information security, coordinating the activities of structural divisions of the organization in the course of work on the creation, development and operation of information infrastructure facilities in compliance with the requirements for ensuring information security.

The policy does not regulate the issues of organizing the protection of premises and ensuring the safety and physical integrity of information infrastructure components, protection against natural disasters, and failures in the power supply system, however, it involves building an information security system on the same conceptual foundations as the security system of the organization as a whole.

The implementation of the policy is ensured by the relevant guidelines, regulations, procedures, instructions, guidelines and information security assessment system in the organization.

The following terms and definitions are used in the Policy:

Automated system ( AC) — a system consisting of personnel and a set of means for automating its activities, implementing information technology for performing established functions.

Information infrastructure— a system of organizational structures that ensure the functioning and development of the information space and means of information interaction. The information infrastructure includes a set of information centers, data and knowledge banks, communication systems, and provides consumers with access to information resources.

Informational resources ( IR) - these are separate documents and separate arrays of documents, documents and arrays of documents in information systems ( libraries, archives, collections, databases and other information systems).

Information system (IP) - information processing system and related organizational resources ( human, technical, financial, etc.) that provide and disseminate information.

Safety - state of protection of interests ( goals) organizations under threat.

Information Security ( IS) — security associated with threats in the information sphere. Security is achieved by providing a set of IS properties - availability, integrity, confidentiality of information assets. The priority of IS properties is determined by the value of these assets for interests ( goals) organizations.

Availability of information assets − property of an organization's information security, which consists in the fact that information assets are provided to an authorized user, moreover, in the form and place required by the user, and at the time when he needs them.

Integrity of Information Assets − the property of an organization's information security to remain unchanged or correct detected changes in its information assets.

Confidentiality of Information Assets − property of the organization's IS, which consists in the fact that the processing, storage and transfer of information assets is carried out in such a way that information assets are available only to authorized users, system objects or processes.

Information security system ( NIB) — a set of protective measures, protective equipment and processes for their operation, including resource and administrative ( organizational) provision.

Unauthorized access- access to information in violation of the official powers of the employee, access to information closed for public access by persons who do not have permission to access this information or obtaining access to information by a person who has the right to access this information in an amount exceeding what is necessary to perform official duties.

2. General requirements for ensuring information security

information security requirements Further -IS ) determine the content and objectives of the organization's activities within the framework of information security management processes.

These requirements are formulated for the following areas:

assignment and distribution of roles and trust in staff;
life cycle stages of information infrastructure objects;
protection against unauthorized access ( Further - NSD ), access control and registration in automated systems, in telecommunications equipment and automatic telephone exchanges, etc.;
anti-virus protection;
use of Internet resources;
use of means of cryptographic protection of information;
protection of personal data.

3. Objects to be protected

The main objects to be protected are:

informational resources, presented in the form of documents and arrays of information, regardless of the form and type of their presentation, including, among other things, confidential and open information;
system of formation, distribution and use of information resources, libraries, archives, databases and data banks, information technology, regulations and procedures for collecting, processing, storing and transmitting information, technical and maintenance personnel;
information infrastructure, including systems for processing and analyzing information, hardware and software for its processing, transmission and display, including channels of information exchange and telecommunications, systems and means of protecting information, facilities and premises in which components of the information infrastructure are located.

3.1. Features of the Automated System

The AS circulates information of different categories. Protected information can be shared between different users from different subnets of a single corporate network.

A number of AS subsystems provide for interaction with external ( state and commercial, Russian and foreign) organizations via dial-up and dedicated communication channels using special means of information transmission.

The complex of technical means of the AU includes data processing tools ( workstations, database servers, mail servers and so on.), means of data exchange in local computer networks with the ability to access global networks ( cabling, bridges, gateways, modems, etc.), as well as storage facilities ( including archiving) data.

The main features of the functioning of the AS include:

the need to combine into a single system a large number of various technical means of processing and transmitting information;
a wide variety of tasks to be solved and types of processed data;
consolidation in single databases of information for various purposes, belonging and confidentiality levels;
availability of channels for connecting to external networks;
continuity of operation;
the presence of subsystems with different requirements for security levels, physically united in a single network;
variety of categories of users and service personnel.

In general terms, a single AS is a collection of local computer networks of departments, interconnected by means of telecommunications. Each local area network unites a number of interconnected and interacting automated subsystems ( technological areas) that ensure the solution of problems by individual structural divisions of the organization.

Informatization objects include:

technological equipment ( computer equipment, network and cable equipment);
informational resources;
software ( operating systems, database management systems, general system and application software);
automated communication and data transmission systems (telecommunication means);
channels of connection;
service premises.

3.2. Types of organizational information assets to be protected

In the AS subsystems of the organization, information of various levels of confidentiality circulates, containing information of limited distribution ( official, commercial, personal data) and public information.

The AS document flow contains:

payment orders and financial documents;
reports ( financial, analytical, etc.);
information about personal accounts;
Personal Information;
other restricted information.

All information circulating in AS and contained in the following types of information assets is subject to protection:

information constituting a commercial and official secret, access to which is limited by the organization as the owner of the information, in accordance with the provisions of the Federal Law " About information, informatization and information protection » Rights and Federal Law « About trade secret »;
personal data, access to which is restricted in accordance with the Federal Law " About personal data »;
open information, in terms of ensuring the integrity and availability of information.

3.3. Categories of users of the Automated system

The organization has a large number of categories of users and maintenance personnel who must have different powers to access the information resources of the AU:

ordinary users ( end users, employees of organizational units);
server administrators ( file servers, application servers, database servers), local computer networks and applied systems;
system programmers ( responsible for maintenance of common software) on servers and user workstations;
application software developers;
specialists in the maintenance of technical means of computer technology;
information security administrators, etc.

3.4. Vulnerability of the main components of the Automated System

The most vulnerable AS components are network workstations - workstations ( Further - workstation ) workers. Attempts of unauthorized access to information or attempts of unauthorized actions can be made from the workstation of employees ( unintentional and intentional) in a computer network. Violations of the configuration of the hardware and software of workstations and unlawful interference in the processes of their functioning can lead to blocking of information, the impossibility of solving important tasks in a timely manner and the failure of individual workstations and subsystems.

Network elements such as dedicated file servers, database servers, and application servers need special protection. Shortcomings of exchange protocols and means of access control to server resources can allow unauthorized access to protected information and influence the operation of various subsystems. At the same time, attempts can be made as a remote ( from network stations) and direct ( from the server console) impact on the operation of servers and their protections.

Bridges, gateways, hubs, routers, switches and others network devices, channels and means of communication also need to be protected. They can be used by intruders to restructure and disrupt network operation, intercept transmitted information, analyze traffic, and implement other methods of interfering in data exchange processes.

4. Basic principles of ensuring information security

4.1. General principles of safe operation

Timeliness of problem detection. The organization must promptly detect problems that could potentially affect its business objectives.
Predictability of development of problems. The organization must identify the cause-and-effect relationship of possible problems and build on this basis an accurate forecast of their development.
Assessing the impact of problems on business goals. The organization shall adequately assess the impact of identified problems.
Adequacy of protective measures. The organization should choose protective measures that are adequate to the threat and attacker models, taking into account the costs of implementing such measures and the amount of possible losses from the execution of threats.
Effectiveness of protective measures. The organization shall effectively implement the protective measures taken.
Using experience in making and implementing decisions. The organization should accumulate, generalize and use both its own experience and the experience of other organizations at all levels of decision-making and their implementation.
Continuity of principles of safe functioning. The organization shall ensure the continuity of the implementation of the principles of safe operation.
Controllability of protective measures. The organization shall apply only those safeguards whose correct operation can be verified, and the organization shall regularly evaluate the adequacy of the safeguards and the effectiveness of their implementation, taking into account the impact of the safeguards on the business objectives of the organization.

4.2. Special principles for ensuring information security

The implementation of special principles for ensuring information security is aimed at increasing the level of maturity of information security management processes in the organization.
Definition of goals. The functional and information security objectives of the organization should be explicitly defined in an internal document. Uncertainty leads to “ vagueness” organizational structure, personnel roles, information security policies and the inability to assess the adequacy of the protective measures taken.
Knowing your customers and employees. The organization must have information about its customers, carefully select staff ( workers), develop and maintain corporate ethics, which creates a favorable trusting environment for the activities of the asset management organization.
Personification and adequate division of roles and responsibilities. The responsibility of the organization's officials for decisions related to its assets should be personified and carried out mainly in the form of a guarantee. It should be adequate to the degree of influence on the goals of the organization, fixed in policies, monitored and improved.
Adequacy of roles to functions and procedures and their comparability with the criteria and evaluation system. Roles should adequately reflect the functions performed and the procedures for their implementation adopted in the organization. When assigning interrelated roles, the necessary sequence of their execution should be taken into account. The role should be consistent with the criteria for evaluating the effectiveness of its implementation. The main content and quality of the role being performed are actually determined by the assessment system applied to it.
Availability of services and facilities. The organization must ensure the availability of services and services for its customers and counterparties on time, determined by the relevant agreements ( agreements) and/or other documents.
Observability and evaluability of IS provision. Any proposed protective measures should be designed so that the result of their application is clearly observable ( transparent) and can be assessed by a department of the organization that has the appropriate authority.

5. Goals and objectives of providing security information

5.1. Subjects of Information Relations in the Automated System

The subjects of legal relations when using AS and ensuring the security of information are:

Organization as the owner of information resources;
subdivisions of the organization that ensure the operation of the NPP;
employees of structural divisions of the organization, as users and providers of information in the AS in accordance with the functions assigned to them;
legal entities and individuals, information about which is accumulated, stored and processed in the AS;
other legal entities and individuals involved in the process of creation and operation of the AS ( developers of the system components, organizations involved in the provision of various services in the field of information technology, etc.).

The listed subjects of information relations are interested in providing:

confidentiality of a certain part of the information;
reliability ( completeness, accuracy, adequacy, integrity) information;
protection against the imposition of false ( false, distorted) information;
timely access to the necessary information;
delimitation of liability for violations of legal rights ( interests) other subjects of information relations and established rules for handling information;
the possibility of continuous monitoring and control of the processing and transmission of information;
protection of part of the information from its illegal reproduction ( protection of copyrights, rights of the owner of information, etc.).

5.2. Purpose of Information Security

The main goal of ensuring the security of information is to protect the subjects of information relations from possible material, moral or other damage to them through accidental or deliberate unauthorized interference in the functioning of the AS or unauthorized access to the information circulating in it and its illegal use.

This goal is achieved by ensuring and constantly maintaining the following properties of information and an automated system for its processing:

availability of the processed information for registered users;
confidentiality of a certain part of the information stored, processed and transmitted through communication channels;
integrity and authenticity of information stored, processed and transmitted via communication channels.

5.3. Information Security Tasks

To achieve the main goal of ensuring information security, the information security system of the nuclear power plant should provide an effective solution to the following tasks:

protection against interference in the process of functioning of the AU by unauthorized persons;
differentiation of access of registered users to the hardware, software and information resources of the AS, that is, protection against unauthorized access;
registration of user actions when using protected AS resources in system logs and periodic monitoring of the correctness of system user actions by analyzing the contents of these logs by specialists from security departments;
protection against unauthorized modification and integrity control ( immutability) program execution environment and its recovery in case of violation;
protection against unauthorized modification and integrity control of software used in the AU, as well as protection of the system from the introduction of unauthorized programs, including computer viruses;
protection of information from leakage through technical channels during its processing, storage and transmission through communication channels;
protection of information stored, processed and transmitted via communication channels from unauthorized disclosure or distortion;
ensuring authentication of users participating in information exchange;
survivability cryptographic means protection of information in case of compromise of a part of the key system;
timely identification of sources of threats to information security, causes and conditions that contribute to causing damage to interested subjects of information relations, creation of a mechanism for prompt response to threats to information security and negative trends;
creation of conditions for minimization and localization of damage caused by unlawful actions of physical and legal entities, mitigation of the negative impact and elimination of the consequences of information security breaches.

5.4. Ways to solve the problems of ensuring information security

The solution to the problems of ensuring information security is achieved:

strict consideration of all system resources to be protected ( information, tasks, communication channels, servers, workstations);
regulation of information processing processes and actions of employees of structural divisions of the organization, as well as actions of personnel engaged in maintenance and modification of software and hardware of the AU, on the basis of organizational and administrative documents on information security;
completeness, real feasibility and consistency of the requirements of organizational and administrative documents on the issues of information security;
appointment and training of employees responsible for the organization and implementation of practical measures to ensure the security of information;
empowering each employee with the minimum necessary for the performance of their functional duties of the authority to access the resources of the AU;
clear knowledge and strict observance by all employees using and maintaining the AS hardware and software of the requirements of organizational and administrative documents on information security;
personal responsibility for their actions of each employee participating, within the framework of their functional duties, in the processes of automated information processing and having access to AS resources;
implementation of technological processes of information processing using complexes of organizational and technical measures to protect software, hardware and data;
taking effective measures to ensure the physical integrity of technical means and continuous maintenance of the required level of protection of the NPP components;
application of technical ( software and hardware) means of protecting system resources and continuous administrative support for their use;
delimitation of information flows and prohibition of transmission of information of limited distribution through unprotected communication channels;
effective control over compliance by employees with information security requirements;
constant monitoring of network resources, identification of vulnerabilities, timely detection and neutralization of external and internal threats to the security of a computer network;
legal protection of the interests of the organization from illegal actions in the field of information security.
conducting a continuous analysis of the effectiveness and sufficiency of the measures taken and the information protection tools used, the development and implementation of proposals for improving the information protection system in the AS.

6. Threats to information security

6.1. Information security threats and their sources

The most dangerous threats to the security of information processed in AS are:

privacy violation ( disclosure, leak) information constituting an official or commercial secret, including personal data;
dysfunction ( disorganization of work) AS, information blocking, violation of technological processes, failure to solve problems in a timely manner;
integrity violation ( distortion, substitution, destruction) information, software and other AS resources.

The main sources of threats to the security of AS information are:

unfavorable natural and man-made events;
terrorists, criminal elements;
computer intruders carrying out targeted destructive impacts, including the use of computer viruses and other types of malicious codes and attacks;
software and hardware vendors, Supplies, services, etc.;
contractors involved in the installation, commissioning of equipment and its repair;
non-compliance with the requirements of supervisory and regulatory authorities, current legislation;
failures, failures, destruction/damage of software and hardware;
employees who are legal participants in the processes in the AS and act outside the scope of the granted powers;
employees who are legal participants in the processes in the AS and act within the framework of the granted powers.

6.2. Unintentional actions leading to a breach of information security and measures to prevent them

Employees of the organization who have direct access to the information processing processes in the AS are a potential source of unintended random actions that may lead to information security breaches.

Main unintentional actions leading to violation of information security (actions committed by people accidentally, through ignorance, inattention or negligence, out of curiosity, but without malicious intent) and measures to prevent such actions and minimize the damage caused by them are given in Table 1.

Table 1

Main actions leading to violation of information security
Actions of employees leading to partial or complete failure of the system or disruption of hardware or software; turning off equipment or changing the operating modes of devices and programs; destruction of information resources of the system ( unintentional damage to equipment, removal, distortion of programs or files from important information, including system ones, damage to communication channels, unintentional damage to storage media, etc.)	Organizational arrangements ( ). The use of physical means to prevent the unintentional commission of a violation. Application of technical ( hardware and software) means of restricting access to resources. Reservation of critical resources.
Unauthorized launch of programs that, if used incompetently, can cause a loss of system performance ( freezes or loops) or making irreversible changes in the system ( formatting or restructuring storage media, deleting data, etc.)	Organizational arrangements ( removal of all potentially dangerous programs from the workstation). Application of technical ( hardware and software) means of delimiting access to programs on workstations.
Unauthorized introduction and use of unaccounted programs ( gaming, training, technological and others that are not necessary for the employees to perform their official duties) with subsequent unreasonable expenditure of resources ( processor time, RAM, memory on external media, etc.)	Organizational arrangements ( introduction of bans). Application of technical ( hardware and software) means preventing unauthorized introduction and use of unrecorded programs.
Inadvertently infecting a computer with viruses	Organizational arrangements ( regulation of actions, introduction of prohibitions). Technological measures ( the use of special programs for detecting and destroying viruses). The use of hardware and software that prevent infection with computer viruses.
Disclosure, transfer or loss of access control attributes ( passwords, encryption keys or ES, identification cards, passes, etc.)	Organizational arrangements ( regulation of actions, introduction of prohibitions, increased responsibility). The use of physical means to ensure the safety of the specified details.
Ignoring organizational constraints ( established rules) when working in the system	Organizational arrangements ( ). Use of additional physical and technical means of protection.
Incompetent use, adjustment or illegal deactivation of protective equipment by security personnel	Organizational arrangements ( staff training, increased responsibility and control).
Entering erroneous data	Organizational arrangements ( increased accountability and control). Technological measures to control errors of data entry operators.

6.3. Deliberate actions to violate information security and measures to prevent them

Major intentional acts ( for selfish purposes, under duress, out of a desire for revenge, etc.), leading to a violation of the information security of the AU, and measures to prevent them and reduce the possible damage caused are given in Table 2.

table 2

The main intentional actions leading to information security breach	Measures to prevent threats and minimize damage
Physical destruction or incapacitation of all or some of the most important components of an automated system ( devices, carriers of important system information, personnel, etc.), shutdown or incapacitation of subsystems that ensure the functioning of computing systems ( power supply, communication lines, etc.)	Organizational arrangements ( regulation of actions, introduction of prohibitions). The use of physical means to prevent the intentional commission of a violation. Reservation of critical resources.
The introduction of agents into the number of system personnel ( including the administrative group responsible for security), recruitment ( by bribery, blackmail, threats, etc.) users who have certain permissions to access protected resources	Organizational arrangements ( selection, placement and work with personnel, strengthening control and responsibility). Automatic registration of personnel actions.
Theft of storage media ( printouts, magnetic disks, tapes, storage devices and entire PCs), theft of industrial waste ( printouts, records, discarded media, etc.)	Organizational arrangements ( ).
Unauthorized copying of storage media, reading residual information from RAM and external storage devices	Organizational arrangements ( organization of storage and use of media with protected information). The use of technical means of restricting access to protected resources and automatic registration of receipt of hard copies of documents.
Illegal obtaining of passwords and other details of access control ( undercover, using the negligence of users, by selection, by imitation of the system interface with software tabs, etc.) followed by disguise as a registered user.	Organizational arrangements ( regulation of actions, introduction of prohibitions, work with personnel). The use of technical means that prevent the introduction of programs to intercept passwords, keys and other details.
Unauthorized use of workstations of users with unique physical characteristics, such as the number of a workstation in the network, physical address, address in the communication system, hardware coding unit, etc.	Organizational arrangements ( strict regulation of access to the premises and admission to work on these workstations). The use of physical and technical means of access control.
Unauthorized software modification - the introduction of software "bookmarks" and "viruses" ( Trojan horses and bugs), that is, such sections of programs that are not necessary for the implementation of the declared functions, but allow to overcome the protection system, covertly and illegally access system resources in order to register and transmit protected information or disrupt the functioning of the system	Organizational arrangements ( strict regulation of access to work). The use of physical and technical means of access control and preventing unauthorized modification of the hardware and software configuration of the workstation. Application of software integrity control tools.
Interception of data transmitted over communication channels, their analysis in order to obtain confidential information and clarification of exchange protocols, rules for entering the network and authorization of users, with subsequent attempts to imitate them to penetrate the system	Physical protection of communication channels. Application of means of cryptographic protection of transmitted information.
Interference in the functioning of the system from public networks for the purpose of unauthorized modification of data, access to confidential information, disruption of the work of subsystems, etc.	Organizational arrangements ( regulation of connection and work in public networks). The use of special technical means of protection ( firewalls, security controls and detection of attacks on system resources, etc.).

6.4. Leakage of information through technical channels

During the operation of NPP technical means, the following channels of leakage or violation of the integrity of information, violation of the performance of technical means are possible:

spurious electromagnetic radiation of an informative signal from technical means and information transmission lines;
pickup of an informative signal processed by means of electronic computing equipment on wires and lines that go beyond the controlled area of offices, incl. on the ground and power supply circuits;
various electronic devices for intercepting information ( including "bookmarks") connected to communication channels or technical means of information processing;
viewing information from display screens and other means of displaying it using optical means;
impact on hardware or software in order to violate the integrity ( destruction, distortion) information, operability of technical means, means of information security and timeliness of information exchange, including electromagnetic, through specially implemented electronic and software tools ( "bookmarks").

Taking into account the specifics of processing and ensuring the security of information, the threat of leakage of confidential information ( including personal data) through technical channels are irrelevant for the organization.

6.5. Informal model of a probable intruder

An offender is a person who has attempted to perform prohibited operations ( action) by mistake, ignorance or knowingly with malicious intent ( out of selfish interests) or without it ( for the sake of play or pleasure, for the purpose of self-affirmation, etc.) and using various possibilities, methods and means for this.

The NPP protection system should be built based on the assumptions about the following possible types of intruders in the system ( taking into account the category of persons, motivation, qualifications, availability of special means, etc.):

« Inexperienced (inattentive) user"- an employee who may attempt to perform prohibited operations, access protected AS resources in excess of his authority, enter incorrect data, etc. actions by mistake, incompetence or negligence without malicious intent and using only regular ( available to him) hardware and software.
« amateur"- an employee trying to overcome the protection system without selfish goals and malicious intent, for self-affirmation or from" sports interest". To overcome the protection system and perform prohibited actions, he can use various methods to obtain additional access rights to resources ( names, passwords, etc. other users), shortcomings in the construction of the protection system and available staff ( installed on the workstation) programs ( unauthorized actions by exceeding their authority to use authorized funds). In addition, he may try to use additional non-standard tools and technological software ( debuggers, utility utilities), independently developed programs or standard additional technical means.
« Scammer"- an employee who may attempt to perform illegal technological operations, enter false data and similar actions for personal gain, under duress or out of malicious intent, but using only regular ( installed on the workstation and available to him) hardware and software on their own behalf or on behalf of another employee ( knowing his name and password, using his short absence from the workplace, etc.).
« External intruder (intruder)"- an outsider or former employee acting purposefully out of selfish interests, out of revenge or out of curiosity, possibly in collusion with others. It can use the whole range of information security breaches, methods and means of hacking security systems that are typical for public networks ( in particular IP-based networks), including the remote implementation of software bookmarks and the use of special instrumental and technological programs, using the existing weaknesses in the exchange protocols and the system for protecting the organization's AS network nodes.
« Internal intruder» - an employee registered as a user of the system, acting purposefully out of selfish interests or revenge, possibly in collusion with persons who are not employees of the organization. He can use the whole set of methods and means of hacking the security system, including undercover methods of obtaining access details, passive means (technical means of interception without modifying system components), methods and means of active influence ( modification of technical means, connection to data transmission channels, introduction of software tabs and use of special instrumental and technological programs), as well as combinations of impacts both from within and from public networks.

An insider may be a person from the following categories of personnel:

registered AS end users ( employees of departments and branches);
workers not allowed to work with the AU;
personnel servicing NPP technical facilities ( engineers, technicians);
employees of software development and maintenance departments ( application and system programmers);
technical staff serving the buildings and premises of the organization ( cleaners, electricians, plumbers and other workers who have access to buildings and premises where the AU components are located);
leaders at various levels.

laid-off workers;
representatives of organizations interacting on issues of ensuring the life of the organization ( energy, water, heat supply, etc.);
representatives of firms supplying equipment, software, services, etc.;
members of criminal organizations and competing commercial structures or persons acting on their instructions;
persons who accidentally or intentionally penetrated networks from external networks ( "hackers").

Users and service personnel from among employees have the widest opportunities to carry out unauthorized actions, due to their certain powers to access resources and good knowledge of information processing technology. The actions of this group of violators are directly related to the violation of existing rules and instructions. This group of offenders poses a particular danger when interacting with criminal structures.

Displaced workers can use their knowledge of work technology, safeguards and access rights to achieve goals.

Criminal structures represent the most aggressive source of external threats. In order to implement their plans, these structures can openly violate the law and involve employees of the organization in their activities with all the forces and means available to them.

Hackers have the highest technical qualifications and knowledge of the weaknesses of the software used in the AS. They pose the greatest threat when interacting with working or laid-off workers and criminal structures.

Organizations involved in the development, supply and repair of equipment, information systems pose an external threat due to the fact that occasionally they have direct access to information resources. Criminal structures can use these organizations for temporary employment of their members in order to access protected information.

7. Technical policy in the field of information security

7.1. Main provisions of technical policy

The implementation of a technical policy in the field of information security should proceed from the premise that it is impossible to provide the required level of information security not only with the help of one separate tool ( Events), but also with the help of their simple set. They need to be systematically coordinated with each other ( complex application), and individual elements of the AS should be considered as part of a unified information system in a secure design with an optimal ratio of technical ( hardware, software) funds and organizational measures.

The main directions of the implementation of the technical policy for ensuring the security of information of the AU is to ensure the protection of information resources from theft, loss, leakage, destruction, distortion or forgery due to unauthorized access and special effects.

Within the framework of the indicated directions of the technical policy for ensuring the security of information, the following are carried out:

implementation of a permit system for the admission of performers ( users, service personnel) to works, documents and information of a confidential nature;
restriction of access of performers and unauthorized persons to buildings and premises where confidential work is carried out and information and communication means are located on which ( stored, transmitted) information of a confidential nature, directly to the means of informatization and communications;
delimitation of access for users and maintenance personnel to information resources, software tools for processing and protecting information in subsystems of various levels and purposes included in the AS;
accounting of documents, information arrays, registration of actions of users and maintenance personnel, control over unauthorized access and actions of users, maintenance personnel and unauthorized persons;
prevention of introduction of virus programs, software bookmarks into automated subsystems;
cryptographic protection of information processed and transmitted by means of computer technology and communications;
reliable storage of machine storage media, cryptographic keys ( key information) and their circulation, excluding theft, substitution and destruction;
necessary redundancy of technical means and duplication of arrays and storage media;
reduction in the level and information content of spurious radiation and interference generated by various elements of automated subsystems;
electrical isolation of power supply circuits, grounding and other circuits of informatization objects that go beyond the controlled area;
counteraction to optical and laser means of observation.

7.2. Formation of the information security mode

Taking into account the identified threats to the safety of the nuclear power plant, the information security regime should be formed as a set of methods and measures to protect the information circulating in the nuclear power plant and the infrastructure supporting it from accidental or intentional effects of a natural or artificial nature, entailing damage to the owners or users of information.

A set of measures for the formation of an information security regime includes:

establishment in the AS of the organizational and legal regime of information security ( regulations, HR, office work);
implementation of organizational and technical measures to protect restricted information from leakage through technical channels;
organizational and software and hardware measures to prevent unauthorized actions ( access) to the information resources of the AU;
a set of measures to control the functioning of means and systems for protecting information resources of limited distribution after accidental or deliberate impacts.

8. Measures, methods and means of ensuring information security

8.1. Organizational arrangements

Organizational arrangements- These are organizational measures that regulate the processes of functioning of the AS, the use of their resources, the activities of maintenance personnel, as well as the procedure for users to interact with the system in such a way as to most hinder or exclude the possibility of implementing security threats and reduce the amount of damage if they are implemented.

8.1.1. Formation of security policy

The main goal of organizational measures is to form an information security policy that reflects approaches to information protection, and ensure its implementation by allocating the necessary resources and monitoring the state of affairs.

From a practical point of view, it is advisable to divide the NPP security policy into two levels. The top level includes decisions that affect the activities of the organization as a whole. Examples of such solutions might be:

formation or revision of a comprehensive information security program, determination of those responsible for its implementation;
formulating goals, setting tasks, determining areas of activity in the field of information security;
making decisions on the implementation of the security program, which are considered at the level of the organization as a whole;
provision of normative ( legal) databases of security issues, etc.

The lower-level policy defines the procedures and rules for achieving goals and solving information security problems and details (regulates) these rules:

what is the scope of the information security policy;
what are the roles and responsibilities of officials responsible for implementing the information security policy;
who has access rights to restricted information;
who and under what conditions can read and modify information, etc.

The lower level policy should:

provide for the regulation of information relations, excluding the possibility of arbitrary, monopoly or unauthorized actions in relation to confidential information resources;
determine coalition and hierarchical principles and methods for sharing secrets and restricting access to restricted information;
choose software and hardware cryptographic protection, counteracting unauthorized access, authentication, authorization, identification and other protective mechanisms that provide guarantees for the implementation of the rights and responsibilities of subjects of information relations.

8.1.2. Regulation of access to technical facilities

The operation of secure workstations and the Bank's servers must be carried out in premises equipped with reliable automatic locks, alarm systems and constantly guarded or monitored, which excludes the possibility of uncontrolled entry into the premises of unauthorized persons and ensures the physical safety of protected resources located in the premises ( AWS, documents, access details, etc.). The placement and installation of technical means of such workstations should exclude the possibility of visual viewing of the input ( derived) information by persons who are not related to it. Cleaning of premises with equipment installed in them should be carried out in the presence of the person responsible for whom these technical means are assigned, or the duty officer of the unit, in compliance with measures that exclude access of unauthorized persons to protected resources.

During the processing of restricted information, only personnel authorized to work with this information should be present in the premises.

At the end of the working day, premises with installed protected workstations must be taken under guard.

For the storage of official documents and machine media with protected information, employees are provided with metal cabinets, as well as means for destroying documents.

Technical means that are used to process or store confidential information must be sealed.

8.1.3. Regulation of the admission of employees to the use of information resources

Within the framework of the permit system, it is established: who, to whom, what information and for what type of access can provide and under what conditions; access control system, which involves the definition for all AS users of information and software resources available to them for specific operations ( read, write, modify, delete, execute) using the specified software and hardware access tools.

The admission of workers to work with the AU and access to their resources must be strictly regulated. Any changes in the composition and powers of users of subsystems of the AU should be made in the prescribed manner.

The main users of information in the AS are employees of the structural divisions of the organization. The level of authority of each user is determined individually, observing the following requirements:

open and confidential information are placed on different servers, if possible;
each employee enjoys only the rights assigned to him in relation to the information with which he needs to work in accordance with his official duties;
the boss has the right to view the information of his subordinates;
the most critical technological operations should be carried out according to the rule "two hands"- the correctness of the entered information is confirmed by another official who does not have the right to enter information.

All employees admitted to work in the NPP and NPP maintenance personnel must be personally liable for violations of the established procedure for automated processing of information, rules for the storage, use and transfer of protected system resources at their disposal. Each employee, when hiring, must sign the Commitment to comply with the requirements for the preservation of confidential information and responsibility for their violation, as well as the implementation of the rules for working with protected information in the AS.

Processing of protected information in subsystems of the AU should be carried out in accordance with approved technological instructions ( orders) for these subsystems.

For users protected by workstations, the necessary technological instructions should be developed, including requirements for ensuring the security of information.

8.1.4. Regulation of the processes of maintaining databases and modifying information resources

All operations for maintaining databases in the AU and the admission of employees to work with these databases must be strictly regulated. Any changes in the composition and powers of AS database users must be made in the prescribed manner.

Distribution of names, generation of passwords, maintenance of the rules for delimiting access to databases is entrusted to employees of the Department of Information Technologies. In this case, both regular and additional means of protecting the DBMS and operating systems.

8.1.5. Regulation of maintenance processes and modification of hardware and software resources

System resources to be protected ( tasks, programs, workstation) are subject to strict accounting ( based on the use of appropriate forms or specialized databases).

The hardware and software configuration of workstations where protected information is processed or from which access to protected resources is possible must correspond to the range of functional duties assigned to users of this workstation. All unused (extra) input-output devices ( COM, USB, LPT ports, floppy disk drives, CD and other storage media) on such workstations must be disabled (deleted), unnecessary software and data from the workstation disks must also be deleted.

To simplify maintenance, maintenance and organization of protection, workstations should be equipped with software and configured in a unified way ( in accordance with established rules).

Commissioning of new workstations and all changes in the configuration of hardware and software, existing workstations in the AS of the organization should be carried out only in accordance with the established procedure.

All software ( developed by the organization's specialists, obtained or purchased from manufacturers) should be tested in the prescribed manner and transferred to the organization's program depository. In AS subsystems, only software tools received in the established order from the depository should be installed and used. The use of software in the AS that is not included in the program depository should be prohibited.

Development of software, testing of developed and acquired software, transfer of software into operation must be carried out in accordance with the established procedure.

8.1.6. User training and education

Prior to providing access to the AS, its users, as well as management and maintenance personnel, must be familiar with the list of confidential information and their level of authority, as well as organizational, administrative, regulatory, technical and operational documentation that defines the requirements and procedure for processing such information.

Protection of information in all of the above areas is possible only after the development of a certain discipline among users, i.e. norms that are mandatory for all those who work in the AS. Such norms include the prohibition of any intentional or unintentional actions that disrupt the normal operation of the AS, cause additional resource costs, violate the integrity of stored and processed information, violate the interests of legitimate users.

All employees who use specific subsystems of the AU in their work must be familiar with the organizational and administrative documents for the protection of the AU in the part that concerns them, they must know and strictly follow the technological instructions and general obligations to ensure the security of information. Bringing the requirements of these documents to the persons admitted to the processing of protected information should be carried out by the heads of departments against signature.

8.1.7. Responsibility for violation of information security requirements

For each serious violation of information security requirements by employees of the organization, an internal investigation should be carried out. Appropriate measures of influence should be applied to the perpetrators. The measure of personnel responsibility for actions committed in violation of the established rules for ensuring secure automated processing of information should be determined by the damage caused, the presence of malicious intent and other factors.

To implement the principle of personal responsibility of users for their actions, it is necessary:

individual identification of users and processes initiated by them, i.e. establishing an identifier for them, on the basis of which access differentiation will be carried out in accordance with the principle of reasonableness of access;
user authentication ( authentication) based on passwords, keys on a different physical basis, etc.;
registration ( logging) operation of mechanisms for controlling access to information system resources, indicating the date and time, identifiers of the requesting and requested resources, type of interaction and its result;
reaction to attempts of unauthorized access ( alarm, blocking, etc.).

8.2. Technical means of protection

Technical ( hardware and software) means of protection - various electronic devices and special programs that are part of the AU and perform (independently or in combination with other means) protection functions ( identification and authentication of users, access control to resources, event registration, cryptographic protection of information, etc.).

Taking into account all the requirements and principles for ensuring the security of information in the AS in all areas of protection, the following means should be included in the protection system:

means of authenticating users and AS elements ( terminals, tasks, database elements, etc.) corresponding to the degree of confidentiality of information and processed data;
means of differentiating access to data;
means of cryptographic protection of information in data transmission lines and in databases;
means of registering appeals and monitoring the use of protected information;
means of responding to detected UA or attempts to UA;
means of reducing the level and information content of spurious radiation and pickups;
means of protection against optical means of observation;
means of protection against viruses and malicious programs;
means of electrical decoupling of both NPP elements and structural elements of the premises in which the equipment is located.

The following main tasks are assigned to the technical means of protection against unauthorized access:

identification and authentication of users using names and/or special hardware ( Touch Memory, Smart Card, etc.);
regulation of user access to physical devices of workstations ( drives, I/O ports);
selective (discretionary) access control to logical drives, directories and files;
authoritative (mandatory) differentiation of access to protected data on the workstation and on the file server;
creation of a closed software environment of programs allowed to run, located both on local and network drives;
protection against penetration of computer viruses and malicious programs;
integrity control of protection system modules, disk system areas and arbitrary file lists in automatic mode and by administrator commands;
registration of user actions in a protected log, the presence of several levels of registration;
protection of the data of the protection system on the file server from access by all users, including the network administrator;
centralized management of access control settings on network workstations;
registration of all UA events occurring at workstations;
operational control over the work of network users, changing the operating modes of workstations and the possibility of blocking ( if necessary) of any network station.

The successful application of technical means of protection assumes that the fulfillment of the requirements listed below is ensured by organizational measures and the physical means of protection used:

the physical integrity of all components of the AU is ensured;
every worker system user) has a unique system name and the minimum authority necessary to perform its functional duties to access system resources;
use of instrumental and technological programs on workstations ( test utilities, debuggers, etc.) that allow attempts to hack or circumvent security measures is limited and strictly regulated;
there are no programming users in the secure system, and the development and debugging of programs is carried out outside the secure system;
all changes in the configuration of hardware and software are made in a strictly established manner;
network hardware ( hubs, switches, routers, etc.) is located in places inaccessible to strangers ( special rooms, cabinets, etc.);
the information security service provides continuous management and administrative support for the operation of information protection tools.

8.2.1. Means of identification and authentication of users

In order to prevent unauthorized persons from accessing the AS, it is necessary to ensure that the system recognizes each legitimate user (or limited groups of users). For this, in the system ( in a protected place) should store a number of attributes of each user by which this user can be identified. In the future, when entering the system, and, if necessary, when performing certain actions in the system, the user must identify himself, i.e. specify the identifier assigned to it in the system. In addition, various types of devices can be used for identification: magnetic cards, key inserts, floppy disks, etc.

Authentication ( authentication) of users should be carried out based on the use of passwords (secret words) or special means of authentication to check the unique characteristics (parameters) of users.

8.2.2. Means for restricting access to resources of the Automated System

After recognizing the user, the system must authorize the user, that is, determine what rights are granted to the user, i.e. what data and how it can use it, what programs it can execute, when, for how long and from what terminals it can work, what system resources it can use, etc. User authorization must be carried out using the following mechanisms for implementing access control:

mechanisms for selective access control based on the use of attribute schemes, permission lists, etc.;
mechanisms for authoritative access control based on the use of resource sensitivity labels and user access levels;
mechanisms to ensure a closed environment of trusted software ( individual for each user lists of programs allowed to run) supported by mechanisms for identifying and authenticating users when they log in to the system.

The areas of responsibility and tasks of specific technical means of protection are established based on their capabilities and performance characteristics described in the documentation for these means.

Technical means of access control should be integral part unified access control system:

to the controlled territory;
in separate rooms;
to AS elements and information security system elements ( physical access);
to AS resources ( software-mathematical access);
to information repositories ( storage media, volumes, files, data sets, archives, references, records, etc.);
to active resources ( application programs, tasks, request forms, etc.);
to the operating system, system programs and security programs, etc.

8.2.3. Means for ensuring and monitoring the integrity of software and information resources

Integrity control of programs, processed information and protection means, in order to ensure the invariability of the software environment determined by the provided processing technology, and protection against unauthorized correction of information, should be provided:

means of calculating checksums;
means of electronic signature;
means of comparing critical resources with their reference copies ( and recovery in case of integrity violation);
means of access control ( deny access with modify or delete rights).

In order to protect information and programs from unauthorized destruction or distortion, it is necessary to ensure:

duplication of system tables and data;
duplexing and mirroring of data on disks;
transaction tracking;
periodic monitoring of the integrity of the operating system and user programs, as well as user files;
anti-virus protection and control;
backing up data according to a predetermined scheme.

8.2.4. Security event controls

Controls should ensure that all events are detected and recorded ( user actions, UA attempts, etc.), which may lead to a violation of the security policy and lead to crisis situations. Controls should provide the ability to:

constant monitoring of key network nodes and network-forming communication equipment, as well as network activity in key network segments;
control over the use of corporate and public network services by users;
maintenance and analysis of security event logs;
timely detection of external and internal threats to information security.

When logging security events, the following information should be recorded in the system log:

date and time of the event;
subject identifier ( user, program) performing the registered action;
action ( if an access request is registered, then the object and type of access are noted).

Controls should provide detection and recording of the following events:

user login;
user login to the network;
unsuccessful login or network attempt ( wrong password entry);
connection to a file server;
launching the program;
completion of the program;
an attempt to launch a program that is not available for launch;
an attempt to gain access to an inaccessible directory;
an attempt to read / write information from a disk that is inaccessible to the user;
an attempt to launch the program from a disk that is inaccessible to the user;
violation of the integrity of programs and data of the protection system, etc.

The following main ways of responding to discovered facts of UA should be supported ( possibly with the participation of a security administrator):

notification of the owner of information about UA to his data;
removal of the program ( tasks) from further execution;
notifying the database administrator and security administrator;
terminal shutdown ( workstation), from which UA attempts to access information or illegal actions on the network were carried out;
exclusion of the violator from the list of registered users;
giving an alarm, etc.

8.2.5. Cryptographic means of information protection

One of the most important elements of the AS information security system should be the use of cryptographic methods and means of protecting information from unauthorized access when it is transmitted over communication channels and stored on computer media.

All means of cryptographic information protection in the AS should be based on the basic cryptographic core. For the right to use cryptographic media, an organization must have licenses established by law.

The key system of cryptographic protection means used in the AS should provide cryptographic survivability and multi-level protection against compromise of key information, separation of users by levels of protection and zones of their interaction between themselves and users of other levels.

Confidentiality and imitation protection of information during its transmission over communication channels should be ensured through the use of subscriber and channel encryption in the system. The combination of subscriber and channel encryption of information should ensure its end-to-end protection along the entire path of passage, protect information in case of its erroneous redirection due to failures and malfunctions of the hardware and software of switching centers.

The AS, which is a system with distributed information resources, should also use the means of generating and verifying an electronic signature, which ensure the integrity and legal evidence of the authenticity of messages, as well as authentication of users, subscriber stations and confirmation of the time of sending messages. In this case, standardized electronic signature algorithms should be used.

8.3. Information Security Management

Management of the information security system in the AS is a targeted impact on the components of the security system ( organizational, technical, software and cryptographic) in order to achieve the required indicators and standards of security of information circulating in the NPP in the context of the implementation of the main security threats.

The main goal of organizing the management of the information security system is to increase the reliability of information protection in the process of its processing, storage and transmission.

Management of the information security system is implemented by a specialized control subsystem, which is a set of controls, technical, software and cryptographic tools, as well as organizational measures and interacting with each other control points of various levels.

The functions of the control subsystem are: informational, control and auxiliary.

The information function consists in continuous monitoring of the state of the protection system, checking the compliance of security indicators with acceptable values and immediately informing security operators about situations that arise in the nuclear power plant that can lead to a breach of information security. There are two requirements for monitoring the state of the protection system: completeness and reliability. Completeness characterizes the degree of coverage of all means of protection and parameters of their functioning. The reliability of control characterizes the degree of adequacy of the values of the controlled parameters to their true value. As a result of processing control data, information on the state of the protection system is generated, which is generalized and transmitted to higher control points.

The control function consists in the formation of plans for the implementation of technological operations of the NPP, taking into account the information security requirements in the conditions prevailing for a given point in time, as well as in determining the location of the situation of information vulnerability and preventing its leakage by promptly blocking sections of the NPP where information security threats arise . Management functions include accounting, storage, and issuance of documents and information media, passwords and keys. At the same time, the generation of passwords, keys, maintenance of access control tools, acceptance of new software included in the AS software environment, control of compliance of the software environment with the standard, as well as control over the course of the technological process of processing confidential information is assigned to employees of the Information Technology Department and the Economic Security Department.

The auxiliary functions of the control subsystem include accounting for all operations performed in the AS with protected information, the formation of reporting documents and the collection of statistical data in order to analyze and identify potential information leakage channels.

8.4. Monitoring the effectiveness of the protection system

Monitoring the effectiveness of the information security system is carried out in order to timely detect and prevent information leakage due to unauthorized access to it, as well as to prevent possible special effects aimed at destroying information, destroying informatization tools.

Evaluation of the effectiveness of information protection measures is carried out using organizational, technical and software controls for compliance with the established requirements.

Control can be carried out both with the help of standard means of the information security system, and with the help of special means of control and technological monitoring.

8.5. Features of ensuring information security of personal data

The classification of personal data is carried out in accordance with the severity of the consequences of the loss of the security properties of personal data for the subject of personal data.

About personal data ” to special categories of personal data;
personal data classified in accordance with the Federal Law " About personal data ” to biometric personal data;
personal data that cannot be attributed to special categories of personal data, to biometric personal data, to publicly available or depersonalized personal data;
personal data classified in accordance with the Federal Law " About personal data ” to publicly available or de-identified personal data.

The transfer of personal data to a third party must be carried out on the basis of the Federal Law or the consent of the subject of personal data. In the event that an organization entrusts the processing of personal data to a third party on the basis of an agreement, an essential condition of such an agreement is the obligation of the third party to ensure the confidentiality of personal data and the security of personal data during their processing.

The organization must stop processing personal data and destroy the collected personal data, unless otherwise provided by the legislation of the Russian Federation, within the time limits established by the legislation of the Russian Federation in the following cases:

upon reaching the purposes of processing or when it is no longer necessary to achieve them;
at the request of the subject of personal data or the Authorized body for the protection of the rights of subjects of personal data - if the personal data is incomplete, outdated, unreliable, illegally obtained or not necessary for the stated purpose of processing;
when the subject of personal data withdraws consent to the processing of their personal data, if such consent is required in accordance with the legislation of the Russian Federation;
if it is impossible for the operator to eliminate the violations committed in the processing of personal data.

The organization should define and document:

the procedure for the destruction of personal data ( including material carriers of personal data);
the procedure for processing requests from personal data subjects ( or their legal representatives) regarding the processing of their personal data;
the procedure for actions in case of requests from the Authorized Body for the Protection of the Rights of Personal Data Subjects or other supervisory authorities exercising control and supervision in the field of personal data;
approach to attributing AS to information systems of personal data ( Further - ISPD );
list of ISPDs. The list of ISPDs should include AS, the purpose of which is the processing of personal data.

For each ISPD, the following must be determined and documented:

purpose of personal data processing;
the volume and content of the processed personal data;
list of actions with personal data and methods of their processing.

The volume and content of personal data, as well as the list of actions and methods of processing personal data must comply with the purposes of processing. In the event that in order to carry out the information technology process, the implementation of which is supported by ISPD, there is no need to process certain personal data, these personal data must be deleted.

The requirements for ensuring the security of personal data in ISPD are generally implemented by a set of organizational, technological, technical and software measures, tools and mechanisms for protecting information.

Organization of execution and ( or) the implementation of the requirements for ensuring the security of personal data should be carried out by a structural unit or an official (employee) of the organization responsible for ensuring the security of personal data, or on a contractual basis by an organization - a counterparty of an organization that has a license for the technical protection of confidential information.

The creation of an organization's ISPD should include the development and approval ( statement) the organizational, administrative, design and operational documentation for the system being created provided for by the terms of reference. The documentation should reflect the issues of ensuring the security of the processed personal data.

The development of concepts, technical specifications, design, creation and testing, acceptance and commissioning of ISPD should be carried out by agreement and under the control of a structural unit or an official (employee) responsible for ensuring the security of personal data.

All information assets belonging to the organization's ISPD must be protected from the effects of malicious code. The organization must define and document the requirements for ensuring the security of personal data by means of anti-virus protection and the procedure for monitoring the implementation of these requirements.

The organization must define an access control system that allows to control access to communication ports, input/output devices, removable storage media and external storage devices ISPD.

The heads of operating and servicing ISPD divisions of the organization ensure the security of personal data during their processing in ISPD.

Employees who process personal data in ISPD must act in accordance with the instructions ( management, regulations, etc.), which is part of the operational documentation for ISPD, and comply with the requirements of documents for ensuring IS.

Responsibilities for the administration of protection tools and protection mechanisms that implement the requirements for ensuring the organization's ISPD information security are assigned by orders ( orders) for specialists of the Information Technology Department.

The procedure for the actions of specialists of the Information Technology Department and personnel involved in the processing of personal data must be determined by instructions ( guidelines), which are prepared by the ISPD developer as part of the operational documentation for ISPD.

The specified instructions ( guides):

establish requirements for the qualification of personnel in the field of information security, as well as an up-to-date list of protected objects and rules for updating it;
contain full and up-to-date by time) user authorization data;
contain data on information processing technology to the extent necessary for an information security specialist;
set the order and frequency of analysis of event logs ( journal archives);
regulate other activities.

The configuration parameters of the means of protection and mechanisms for protecting information from unauthorized access, used in the area of responsibility of specialists of the Department of Information Technologies, are determined in the operational documentation for ISPD. The order and frequency of checks of the set configuration parameters are established in the operational documentation or regulated by an internal document, while checks should be carried out at least once a year.

The organization must define and document the procedure for access to the premises where the ISPD technical means are located and personal data carriers are stored, which provides for control of access to the premises by unauthorized persons and the presence of obstacles to unauthorized entry into the premises. The specified procedure must be developed by a structural unit or an official ( worker) responsible for ensuring the physical security regime and approved by the structural unit or official ( worker), responsible for ensuring the security of personal data, and the Department of Economic Security.

ISPD users and maintenance personnel should not carry out unauthorized and ( or) not registered ( uncontrolled) copying personal data. To this end, organizational and technical measures should prohibit unauthorized and ( or) not registered ( uncontrolled) copying personal data, including using alienable ( interchangeable) storage media, mobile devices for copying and transferring information, communication ports and input/output devices that implement various interfaces ( including wireless), storage devices mobile means (e.g. laptops, PDAs, smartphones, mobile phones), as well as photo and video devices.

The control of personal security is carried out by an information security specialist, both with the help of standard means of the information security system, and with the help of special means of control and technological monitoring.

Download ZIP file (65475)

Documents came in handy - put "like" or:

Information plays a special role in the development of civilization. The possession of information resources and their rational use create the conditions for optimal management of society. And vice versa, the distortion of information, blocking its receipt, the use of unreliable data lead to erroneous decisions.

One of the main factors ensuring efficiency in the management of various spheres of public life is the correct use of information of a different nature. The pace of progress today, and even more so tomorrow, largely depends on the state of affairs in the field of information and computing services for the most important areas of activity - science, technology, production and management.

Particularly relevant is the problem of using economic information in the field of material production management, where the growth of the information flow is in quadratic dependence on the industrial potential of the country. In turn, the rapid development of automation processes, the use of computers in all spheres of modern life, in addition to undoubted advantages, led to the emergence of a number of specific problems. One of them is the need to ensure effective information protection. Based on this, the creation of legal norms that fix the rights and obligations of citizens, collectives and the state to information, as well as the protection of this information, become the most important aspect. information policy states. Information security, especially in the economic sphere, is a very specific and important activity. Suffice it to say that in the world the average amount of damage from one bank theft using electronic means is estimated at $9,000. Annual losses from computer crimes in the United States and Western Europe reach $140 billion. computer networks will lead to the ruin of 20% of medium-sized companies within a few hours, 40% of medium and 16% of large companies will fail in a few days, 33% of banks will fail in 2-5 hours, 50% of banks in 2-3 days.

Of interest is information about data protection problems that led to material losses in US companies:

network outages (24%);

software errors (14%);

computer viruses (12%);

malfunctions in computers (11%);

data theft (7%);

sabotage (5%);

unauthorized introduction into the network (4%);

others (23%).

The rapid development and spread of computer systems and information networks serving banks and exchanges is accompanied by an increase in offenses related to theft and unauthorized access to data stored in computer memory and transmitted over communication lines.

Computer crimes occur today in all countries of the world and are common in many areas of human activity. They are characterized by high secrecy, the difficulty of collecting evidence on the established facts of their commission and the difficulty of proving such cases in court. Offenses in the field of computer information can be committed in the form of:

fraud by computer manipulation of the data processing system in order to obtain financial gain;

computer espionage and software theft;

computer sabotage;

theft of services (time), misuse of data processing systems;

illegal access to data processing systems and "hacking" them;

traditional crimes in the field of business (economy) committed with the help of data processing systems.

Computer crimes are committed, as a rule, by highly qualified system and bank programmers, specialists in the field of telecommunication systems. A serious threat to information resources is hackers And crackers, penetrating computer systems and networks by hacking security software. Crackers, moreover, can delete or change the data in the information bank in accordance with their interests. Over the past decades, a powerful generation of highly trained potential hackers has appeared in the countries of the former USSR, who worked in organizations and departments engaged in information piracy at the state level in order to use information received from the West in military and economic interests.

What do hackers steal? A potential object can be any information embedded in a computer, passing through computer networks or located on computer media and capable of bringing profit to a hacker or his employer. This information includes almost all information constituting the commercial secret of firms, ranging from developments and know-how to payrolls, from which it is easy to "calculate" the company's turnover, the number of employees, etc.

Of particular value is information on bank transactions and loans, carried out by e-mail, as well as transactions on the stock exchange. Of great interest to hackers are software products that are valued on the modern market in thousands or even millions of dollars.

Crackers - "computer terrorists" - are engaged in damage to programs or information using viruses - special programs that ensure the destruction of information or system failures. The creation of "viral" programs is a very profitable business, since some manufacturing companies use viruses to protect their software products from unauthorized copying.

For many firms, obtaining information through the introduction of a hacker-programmer to competitors is the most simple and profitable business. Introducing special equipment to rivals, constantly monitoring their office for radiation with the help of special equipment is an expensive and dangerous business. In addition, a competing firm, upon detection of technical means, can start a game in response, giving false information. Therefore, your own hacker-programmer in the “enemy camp” is the most reliable way to fight competitors.

Thus, the ever-increasing danger of computer crime, primarily in the financial and credit sphere, determines the importance of ensuring the security of automated information systems.

Information security of an organization (institution)

Under The security of an automated information system of an organization (institution) is understood as its protection from accidental or deliberate interference in the normal functioning process, as well as from attempts to steal, modify or destroy its components. System security is achieved by ensuring the confidentiality of information processed by it, as well as the integrity and availability of system components and resources.

Confidentiality of computer information - this property of information to be known only to admitted and verified (authorized) subjects of the system (users, programs, processes, etc.).

Integrity component (resource) of the system - the property of the component (resource) to be unchanged (in the semantic sense) during the functioning of the system.

Availability component (resource) of the system - the property of the component (resource) to be available for use by authorized subjects of the system at any time.

System security is ensured by a set of technological and administrative measures applied to hardware, programs, data and services in order to ensure the availability, integrity and confidentiality of computer-related resources; this also includes procedures for checking that the system performs certain functions in strict accordance with their planned work order.

The system security system can be divided into the following subsystems:

computer security;

data security;

secure software;

communications security.

Computer security is provided by a set of technological and administrative measures applied to computer hardware in order to ensure the availability, integrity and confidentiality of resources associated with it.

Data security is achieved by protecting data from unauthorized, accidental, intentional or negligent modification, destruction or disclosure.

Safe Software is a general-purpose and application programs and tools that perform secure data processing in the system and safely use system resources.

Communication security It is provided through telecommunications authentication by taking measures to prevent the provision of critical information to unauthorized persons, which can be issued by the system in response to a telecommunications request.

TO information security objects in an enterprise (firm) include:

information resources containing information classified as commercial secrets and confidential information presented in the form of documented information arrays and databases;

informatization tools and systems - computer and organizational equipment, networks and systems, general system and application software, automated enterprise (office) management systems, communication and data transmission systems, technical means for collecting, registering, transmitting, processing and displaying information, as well as their informative physical fields.

In the modern world, information resources have become one of the powerful levers for the economic development of enterprises (firms) that play an important role in entrepreneurial activity. Moreover, the lack of effective computer and modern information technologies in the sphere of domestic business, which are the basis for the functioning of "fast" economies, significantly slows down the transition to new forms of management.

In information and automated management systems for an enterprise (firm), the forefront is the provision of an effective solution to the problems of marketing management, i.e., the tasks of accounting and analyzing contracts and contacts of an enterprise (firm), searching for business partners, organizing advertising campaigns promoting goods, providing intermediary services, developing a market penetration strategy, etc.

Without the support of various political, commercial and official power structures, it is usually possible to carry out any serious operation qualitatively only by hiding one's true activity (“illegal deeds”) and one's true face (“illegal persons”).

This applies both to an amateur individual and to an informal grouping specially created to solve some delicate tasks that do not enjoy universal approval.

The same problem arises when, for some reason, a person needs to hide from various services of a commercial, state, criminal, political kind.

You can become a typical illegal immigrant both intentionally and involuntarily. In any case, however, it is necessary to know at least a minimum of standard security tactics in order to successfully slip through this period without losing physical or mental freedom, and sometimes life itself, due to sheer stupidity.

Elements of the security system

The level of insurance measures used depends strongly both on the degree of desired secrecy of a person (or group), and on the situation, environment and, of course, on the capabilities of the insured themselves.

Separate personal safety techniques should become a natural habit and be performed regardless of the needs of the momentary situation.

What is presented here does not exhaust the possible means of ordinary insurance, the criterion for the use of which is always a high opinion of the enemy and, of course, the common sense of the insurers themselves.

The following types of security are typical:

External (during communication with strangers);

Internal (when contacting in one's environment and group);

Local (in various situations and actions).

Let's consider all this in a little more detail.

External Security

Various troubles can arise when communicating with ordinary people and government agencies, but a lot here can be foreseen and avoided using the banal principle of three “not”: do not annoy, do not get involved, do not stand out.

Necessary:

Do not draw too much attention to yourself (tactics of "dissolving in the environment"):

- do not stand out in appearance (ordinary haircut, decent clothes, the absence of anything "loud"; if, however, your environment is extravagant, then - be like them ...);

- do not get involved in quarrels and scandals (this, firstly, attracts unnecessary attention to you, and secondly, it can simply be a provocation aimed at detention or "punishment");

– carefully pay all utility bills and other state duties; always pay for travel in public transport;

- try to follow exactly the pattern of the chosen social role and not have complaints about work (and not stand out against the general collective background there ...);

- do not inflame the obsessive curiosity of neighbors with an unusual lifestyle or visits from different people;

- do not show excessive awareness of anything, unless, of course, your role requires it (do not forget the ancients: “The vigilant must have a law of three nos: “I don’t know”, “I didn’t hear”, “I don’t understand”) .

Do not generate any hostility in neighbors, colleagues and acquaintances, but arouse their sympathy:

- not to be a "black sheep" (people are always disposed to by the one who reveals himself from a side that they understand ...);

- develop a demeanor that does not cause possible alertness in others (excessive curiosity, “mind” or obsession ...) or hostility (tactlessness, tediousness, pride, rudeness ...);

- be even and amiable with everyone around and, if possible, provide them with minor (but not lackey!) services;

– not to do anything that may cause discontent and curiosity of neighbors (slamming the door at night, an excess of visitors, returning home by taxi, women visiting, calling late on the phone in a shared apartment ...).

Carefully control all your connections and contacts (remember that “the most dangerous enemy is the one you don’t suspect”):

- to keep secrets from their neighbors (wife, friends, relatives, mistresses ...);

- with habitual alertness (“why and why?”) Always perceive attempts to get close to you (accidental acquaintance, someone's recommendations ...);

- be attentive to all employees of repair services, advertising and service, look through their documents and politely, but reasonably, verify their identity by phone, and then with “colleagues”;

- be careful with everyone who offers seemingly “disinterested” services (loans money, actively helps in something, provides something you need on the cheap ...).

Find out your own vulnerabilities and know how you can play it safe here:

- analyze your whole life and highlight those dubious moments that can be used for blackmail or discredit;

- realistically assess the possible consequences of the disclosure of such facts to all those to whom they can be reported;

- estimate who and for what reason is able to know compromising evidence and how it is possible to neutralize such awareness;

- identify the objects of your vulnerability (woman, children, moral principles ...), because through them you can be pressured;

- identify your weaknesses (hobbies, wine, sex, money, character traits ...) and remember that they can always be used against you.

- Do not get involved in dubious scams that are not related to the common cause. In risky adventures related to the case, but only with permission from above.

internal security

Contacts in your own environment cannot be considered secure. Remember that "the greatest harm usually comes from two conditions: from divulging a secret and trusting the treacherous."

Preservation of the secret of identity:

– instead of real names, pseudonyms are always used (usually nominal, but also numeric, alphabetic or “nicknames”); in each direction, the “players” go under a separate pseudonym, although it is possible to work under several options, as well as to act under a common pseudonym of several different persons;

– team members, if possible, know each other only under pseudonyms; only trusted persons should be aware of real names, home addresses and telephone numbers;

- with the impending possibility of failure and decryption, all used pseudonyms, as a rule, change;

- you should not give anyone any intimate or other information about your own person;

- try to create (using hints or rumors) a fictional, but outwardly plausible "legend" about yourself;

- no one in the group should show excessive interest in the activities, habits and intimate life of their comrades;

- no one should disclose any data about partners to others, unless it is required by an urgent need;

- in some cases, it makes sense to visually change the appearance (hairstyle, beard, makeup, wigs, tattoos, skin color, glasses with plain or smoky glasses and different frames, inserts that change voice and gait ...);

- you need to get into the habit of not leaving behind any material traces indicating that you were here (cigarette butts, discarded pieces of paper, footprints, contrasting odors, noticeable changes in the environment ...).

Keeping the case secret:

- active working contacts are maintained with a strictly limited set of people (a system of triples or fives, depending on the tasks being solved ...), while the partners should not know what exactly the partners are doing;

- everyone specializes in only two or three areas, after it became too dangerous for him to engage in activities in one of them - a respite is possible, as well as a transition to another direction;

- it is necessary to strictly distinguish between operational and information work: let everyone mind his own business;

- the best way is to mask the preparation for a specific action of the event to implement another;

- you can tell others about your activities only if it is necessary for them for the cause; remember that the secret is kept by a maximum of five people;

- it is necessary to transfer the received information only to those who obviously need it (showing excessive awareness of something can reveal the source of information, and this can lead to its neutralization);

– be careful when using means of communication that provide clear opportunities for intercepting information (postal messages, radio - and telephone conversations ...);

– never write real addresses, names and settings in plain text in letters, do not mention them in conversations conducted on the street or on the phone;

- use codes and pseudonyms even during intra-group communication, changing them from time to time;

- the group should have 2-3 separate ciphers known to different people;

- rely more on memory than on recording; in the latter case, you must use your personal code and cipher;

- try not to have compromising papers written in your own handwriting or printed on your own office equipment;

- when communicating with "exposed" persons, refrain from direct contacts, using, if necessary, bystanders or other means of communication;

- always take into account and remember that there is a possibility of information leakage or betrayal, and be ready for appropriate counter-actions.

Local Security

The best guarantee success is usually a safety net, and therefore it is desirable to carry out any actions taking into account all possible troubles on the part of the enemy or bystanders who accidentally turn up.

General rules for direct communication.

try not to conduct informative conversations in plain text on a crowded street or in public transport;

real surnames, first names, well-known nicknames and addresses should not be mentioned in an open conversation, and also “alarming” terminology should not be used;

use code names to designate individual actions;

the most secret aspects of the conversation (real addresses, passwords, dates) are written on paper, which is then destroyed;

it is necessary to navigate the technical capabilities of eavesdropping systems and know the elementary measures to counter them (see the section on obtaining information ...);

if one of the interlocutors notices something alarming during the conversation, the partner is warned by a special word (“atas” ...) or by a gesture (finger to lips ...), and the whole conversation is transferred to a neutral channel;

if you know that you are being eavesdropped on, it is better not to conduct informative negotiations or use them for disinformation;

when they supposedly “listen” to you, but still need to communicate, they use conditional language, where harmless sentences have a completely different meaning; phrases are also used that should not be taken into account (they are usually reported by some agreed gesture, for example, crossing fingers ...), and often standard tricks (coughing, liners in the mouth ...) that make it difficult to identify the speaker;

when it is necessary to ensure the complete secrecy of communication in a crowded place, methods of conditional (non-verbal) communication are used, such as the language of gestures, body movements and finger gestures, as well as codes based on clothing attributes (different positions of a headdress, tie clip, handkerchief ...) or to manipulate improvised objects (watches, cigarettes, keys…).

Phone use

A. PERSONAL SAFETY:

- try to negotiate the time of other people's and your own calls and limit the frequency of contacts;

- do not abuse conversations on your own phone (considering that it can be tapped) and do not give others your number without a clear need (knowing that it is easy to get to your address using it);

- take into account that they can listen to both the entire telephone conversation (when connected on the line ...), and only what you are talking about (a planted "bug" or a neighbor outside the door ...);

- it is useful to build in the device the simplest "control" (fixing the voltage drop ...) for connecting someone else's equipment to the line;

- use ANI (automatic caller ID), but it would be better to use “anti-anti-caller” so as not to advertise your number when calling others;

– do not rely on the reliability of any radiotelephones;

- long-distance and other fixed contacts are best made from someone else's "number" via a cellular "double" or radio extension cable (see the section on blackmail ...), as well as through a direct connection to any pair of contacts in the switchboard;

- for greater secrecy of negotiations, scramblers can be used (at least simple impromptu inverters and scramblers), although their use can sharply stimulate the attention of others;

– one should not rely too much on protection by means of “noise” or “voltage rise in the line”;

– if you do not want to “decipher” the interlocutor, then you can try to change your voice (through mechanical and electronic tricks, or by simply coughing, pulling and spreading your lips, pinching your nose ...) and the stylistic pattern of the conversation (using jargon ...);

- do not forget that sometimes payphones are tapped, the location of which is easily calculated, like all other phones;

- if you need someone else's call, but there is no desire to give your coordinates, an intermediate one is used - with an answering machine or a live "dispatcher", who may either know or not know (one-way option ...) your private number - telephone;

- in some cases, wordless use of the phone is possible, when one, and more often several "empty" calls in a certain rhythm show some code;

- a specific signal can sometimes be just the fact of a call from a certain person during the most trifling conversation, as well as the code mention of conditional names in case of a “mistake number”.

B. VERBAL SAFETY:

- do not conduct business conversations in plain text;

- do not give real dates, names, addresses;

- use code names for individual actions;

- use conditional language in which harmless phrases have a completely different meaning;

- call only when necessary, although it is also possible to have frequent “irrelevant” conversations with the same person (the tactic of “information dissolution”).

B. CONVERSATION WITH OUTSIDERS:

- the partner conducts the entire dialogue, and you just say “yes” or “no” so that those standing next to you do not understand and do not know;

- the fact that outsiders are nearby is reported in plain text or verbal code; the conversation after this should be conducted by a partner who is not appropriate to ask any questions that require detailed answers;

- when there is direct control of a not very friendly person, the partner is warned about this by a negotiated phrase-code (preferably in a greeting ...), after which the whole conversation is carried on in an empty or disinformation style;

- if one of the interlocutors believes that his phone is being tapped, he immediately tries to warn those who call him about this by means of a well-known phrase (“teeth hurt” ...), and the conversation then turns into a neutral channel.

D. USE OF A COMMON PHONE (AT APARTMENT, AT WORK…):

- use such a phone as little as possible (especially “at the reception”), if this is not related to the role being played (dispatcher, advertising agent ...);

- call to this phone must be the same person;

– try not to call too late and too early;

- when outsiders try to identify the voice of the caller ("Who asks?" ...), answer politely and neutrally ("colleague" ...) and, if the callee is not there, immediately stop further conversation;

- in fact, it is not difficult to make a separate telephone using, for example, a code splitter, so that in this case a specific dialing of a common number will reliably ensure that only your telephone is called, without affecting the neighboring one in any way.

Organization of meetings

The level of security measures required in specific cases depends on the desired degree of secrecy of the contact, on the degree of legality of its participants and the possible control of it by outsiders.

A. SELECTION OF THE MEETING PLACE:

- when looking for suitable places for contact, they usually rely on the principles of naturalness, validity and chance;

- frequent meetings are easiest to carry out at the place of a fan party (fitting into its pattern ...), in the hall of the sports section, in the working room ...;

- especially serious gatherings can be realized in hunting grounds, specially rented dachas, in baths, resort sanatoriums, at all kinds of sports bases, on beaches abroad;

- pair meetings are scheduled in the subway and squares, in toilets and in cars, on sparsely busy streets, in zoos, museums and at exhibitions; crossings in such places are unlikely, and therefore they are less dangerous;

– one should refrain from conspiratorial meetings in a well-known restaurant, trendy cafe and train station, given that such points are usually controlled;

- it is possible to hold “random” meetings in private apartments of third parties for a justified reason (funeral, anniversary, “washing” of some event ...);

- you should not carry out any meetings (except for the usual ones) in stereotypical communal apartments;

- extremely limited use of their own apartments for contacting;

- in some cases it makes sense to rent a special safe house, if possible in the house where there is a duplicate exit;

– when inspecting the meeting place, make sure that it is possible to get there unnoticed and how it is possible to escape safely from there; remember the old truth: “If you don’t know how to leave, don’t try to enter!”

B. MEETING INFORMATION:

- the places of a possible meeting are usually discussed in advance, and all of them are given a code - alphabetic, digital or "false" - name, with several options for each;

- the intended contact is communicated to others by phone, pager, letter, and also through a messenger;

- when arranging a meeting on the lines of "open" communication, they use the code name of the place, an encrypted date (for example, the day before the specified one) and a shifted time (by a constant or rolling number);

– before the due date, it is necessary to issue a confirmation of contact either in plain text or by signaling;

- if waiting is acceptable at the meeting (at a public transport stop, in line at a gas station ...), it is advisable to indicate a specific period of time after which it is no longer necessary to wait.

B. HOLDING A MEETING:

- to crowded meetings, one should arrive not in a crowd, but dispersed and not leaving all personal cars in one place;

- try to avoid the presence of any outsiders and extra persons at the training camp;

– realizing that those who don’t need to know about crowded secret meetings are likely to know, you should not take obviously compromising things with you (weapons, forged documents ...) and remember that they can sometimes be slipped;

- control of the place of communication is highly desirable special people before, during and after the meeting, so that, if necessary, they can warn of an emerging danger using any agreed (considering their capture) signals;

- with all contact, you need to figure out how you can be spied on or overheard, stubbornly asking yourself short questions: “Where? How? Who?";

- especially secret conversations should be carried out in local isolated points, checked and secured against all possibilities of eavesdropping, peeping and undermining;

- it is desirable to have at least simple indicators that report the radiation of radio microphones or the presence of a recording voice recorder on the interlocutor;

- it is useful to use even "clumsy" spark silencers, as well as magnetic record erasure generators;

- classic illegal doubles matches are always calculated to the minute and are held as "random";

- in order to arrive at the meeting point at exactly the appointed time, it is necessary to time the movement in advance and give some margin of time for all sorts of surprises (blocking the route, tying an outsider, a traffic accident ...);

- if the meeting is scheduled on the street, then it does not interfere with walking there an hour before the meeting, carefully looking at every passer-by and all parked cars; if something worries you, then the contact must be postponed, informing your partner about this using camouflaged signal communication techniques;

- when meeting with unfamiliar persons, the latter are recognized by their description appearance, a specific pose or gesture, a mention of things held in the hands, and best of all - from a photograph, with further confirmation of identity with a verbal (and other) password;

- it is necessary to be located in the hospital in such a way that at all times it is necessary to control the obvious places of occurrence of the threat (say, in a cafe - facing the entrance, while watching what is happening outside the window and being located not far from the open service passage ...);

- remember and follow all the previously indicated rules of verbal communication.

D. ORGANIZATION OF CLOSED MEETINGS (NEGOTIATIONS).

The organization of any event, including meetings and negotiations, is associated with its preparation. There are no single infallible rules in this direction. However, the following variant of the scheme for such preparation is recommended: planning, collection of material and its processing, analysis of the collected material and its editing.

At the initial stage of planning, the topic or issues that are desirable to be discussed, and possible participants in the business conversation are determined. In addition, the most opportune moment is chosen, and only then do they agree on the place, time of the meeting and the organization of the security of the enterprise (as a rule, such conversations are conducted tete-a-tete, confidentially, without the participation of outsiders).

When the meeting is already scheduled, a plan is drawn up for its holding. First, you should determine the goals facing the entrepreneur, and then develop a strategy for achieving them and tactics for conducting a conversation.

Such a plan is a clear program of actions for preparing and conducting a specific conversation. Planning allows you to mitigate, neutralize the impact of unexpectedly emerging new facts or unforeseen circumstances on the course of the conversation.

The plan includes those responsible for the implementation of each item of the plan and the following measures to organize the security of the meeting (negotiations):

1. Meeting with the client of the guests arriving for the meeting.

2. Coordination of the actions of the main guards and bodyguards of invited persons.

3. Protection of clothes, belongings of guests and their cars in the surrounding area.

4. Prevention of incidents between guests at a meeting.

5. Monitoring the status of drinks, snacks and other treats (trained dogs are used for these purposes).

6. Identification of suspicious persons at the event or in adjacent premises.

7. Cleaning of premises (negotiation hall and adjoining rooms) prior to negotiations in order to remove eavesdropping and explosive devices.

8. Establishment of posts for fixing and monitoring persons:

a) those who come to a business reception or meeting with bundles, briefcases, etc.;

b) bringing audio or video equipment to the event;

c) who come to a business reception or meeting for a short time or leave the event unexpectedly.

9. Prevention of listening to the conversations of the organizers of the event and guests in the premises and on the phone.

10. Development of fallback options for negotiations (in a private apartment, in a hotel, in a car, on a boat, in a bathhouse (sauna), etc.)

This list of activities is not exhaustive. It can be significantly expanded and specified depending on the conditions of the object of protection, the nature of the event and other conditions agreed with the client.

Among the general tasks that are solved during a meeting (negotiations) or other public events include:

1) the premises for negotiations are selected in such a way that they are located on the first or last floors and are located between those premises that are controlled by the security service;

2) familiarization with the object of protection, establishing the state of the criminal situation around it;

3) establishing interaction with the police during the period of the events;

4) establishment of a pass regime in order to prevent the carrying of weapons, explosives, combustible and poisonous substances, drugs, heavy objects and stones to the protected object;

5) prevention of passage to the protected area or to the protected premises of persons with dogs;

6) control and maintenance of order in the adjacent territory and in adjacent premises;

7) distribution of roles among the guards of the reinforcement (support) group;

8) determination of the equipment of the guards, including their weapons and communications;

9) establishment of open and "encrypted" control and observation posts;

10) preparation of transport in case of extreme circumstances and evacuation of participants in the event;

11) checking the stability of communication on the territory of the facility in order to identify the so-called "dead zones";

12) checking the possibility of using gas weapons and tear gas canisters in order to identify the direction of air movement, drafts and eddies, so that the guards themselves do not suffer as a result of the use of special means;

13) checking the coherence of the guards by practicing various introductory tasks.

During the working stage of protection, the security service (security company) employees must accurately fulfill their duties stipulated at the preparation stage.

In doing so, special attention is paid to the following questions:

1) the arrival of late participants of the event who rely on a weak access control after the start of the meeting (negotiations);

2) mandatory inspection of the contents of briefcases and bulky bags or the use of hand-held metal detectors, explosive vapor detectors used to detect mines, grenades, heavy bombs and other explosives;

3) vehicles entering and leaving the protected area should be subjected to special inspection, at least visually. This is especially important in order to prevent outsiders from entering the protected facility and to exclude the mining of vehicles of the participants in the meeting (negotiations);

4) control of passenger compartments and luggage compartments of departing vehicles can prevent the kidnapping of persons arriving at the event in order to extort the organizers of the meeting (negotiations);

5) protection of outerwear and personal belongings of the participants of the event in order to exclude its theft and establish radio bugs;

6) despite the desire of the leaders of the event to have a beautiful view from the window, it must be taken into account that the area should be convenient for control by the security service (security company);

7) under the windows of the negotiation rooms, cars should not be parked, in which there may be equipment for picking up information from radio bookmarks;

8) creation of security zones of the premises intended for negotiations, and equipping it with special equipment, screens, noise generators, etc.;

9) when negotiating for the purpose of maintaining a commercial secret, all "secret" information is presented in writing, and its discussion is in Aesopian.

At the final stage of the event, it is required to remain vigilant by the security service (security company), despite the outwardly seeming insignificance of the events taking place at the facility, which can be very deceptive.

Checking the object after the completion of the event can be associated with no less risk to life than work at the previous stages. During this period, the final cleaning of the object is carried out according to the same methodology as during the preparatory measures. At the same time, it is necessary to search for persons who can hide at the facility, or victims of criminals who require medical assistance. Close attention is drawn to forgotten objects and things.

Souvenirs and gifts presented to the head of the organization (company), other participants of the event are subjected to control inspection.

Everything found by the security at the facility that does not belong to the employees of the organization (firm) is subject to transfer to the client or the administration of the protected premises along with one copy of the inventory. The second copy of the inventory with the signature of the person who accepted the things for storage is in the security service (security company).

An apartment, a car, a street, a restaurant cannot be reliable "defenders" of trade secrets. Therefore, it is worth listening to the advice of professionals.

When holding business meetings, it is imperative to close windows and doors. It is desirable that an isolated room, such as a hall, serve as a meeting room.

Competitors, if they want, can easily listen to conversations, located in neighboring rooms, for example, in an apartment on the floor above or below. The times when scouts of all countries and peoples drilled holes in ceilings and walls are long gone - especially sensitive microphones allow you to receive the necessary information almost without hindrance.

For negotiations, it is necessary to choose rooms with insulated walls, get to know the neighbors living on the floor above and below; find out if they rent their apartment (room) to strangers. It is worth turning neighbors into allies, but at the same time take into account that they can play a double game or quietly turn from well-wishers into blackmailers.

The activity of competitors depends, first of all, on the seriousness of their intentions. If necessary, listening devices ("bugs") can be installed directly in the entrepreneur's apartment - and neither iron doors, nor imported locks, nor well-trained security will help here.

A business person should ask his relatives to invite home only well-known people, if possible, control their behavior. During the reception, the doors of the home office should be locked, and in order not to tempt children, the VCR and computer should be in an accessible place for them. The computer, of course, should be without working programs and confidential information.

If it is suspected that your vehicle is “equipped”, a “clean vehicle” operation must be carried out in it before negotiations.

On the eve of a business meeting, one of the employees of the company or a friend of the entrepreneur, whom he fully trusts, must leave the car at the agreed place. A few minutes after that, the business man changes from his car to the abandoned one and, without stopping anywhere, goes to the negotiations. In this case, you should not forget to take a power of attorney for the right to drive someone else's car!

During negotiations, the car must be in motion, and its windows tightly closed. At stops (for example, at a traffic light), it is better not to discuss confidential issues.

Let's analyze where else a business person can hold an important business meeting?

On the street. To listen to conversations, two types of microphones can be used - highly directional and built-in. The former allow you to take information at a distance of up to a kilometer within the line of sight. The built-in microphones function in the same way as radio tabs.

To effectively deal with highly directional microphones, it is necessary to move all the time, sharply changing the direction of movement, while using public transport by organizing counter-surveillance - with the help of the security service or hired agents of private detective firms.

At the restaurant. The static position allows you to control conversations in the general restaurant halls. Therefore, a reliable maitre d' is essential for holding such business meetings. At a convenient time for the entrepreneur and unexpectedly for competitors, a table or a separate office is reserved, which, in turn, must be under the reliable control of the company's security service. Attempts to drown out the conversation with the sounds of a restaurant orchestra, as, by the way, with the sound of water, are ineffective.

In a hotel room. Booking a hotel room for negotiations must be carried out discreetly. After the start of a business meeting, security officers must keep under control not only neighbors, but also all people living on the floor above and below.

All of the above methods and countermeasures are effective provided that misinformation of others about the time and nature of the planned meetings (negotiations) is well organized. When the circle of employees dedicated to the full list of planned events is as narrow as possible and each of those participating in them knows exactly as much as is necessary for the scope of his duties, then you can count on success in any business.

Protection of information objects

Types of threats to information objects

The general classification of threats to the automated information system of an object is as follows:

Threats to data and software privacy. They are implemented in case of unauthorized access to data (for example, to information about the status of accounts of bank customers), programs or communication channels.

Information processed on computers or transmitted over local networks data transmission, can be removed through the technical channels of the leak. In this case, equipment is used that analyzes electromagnetic radiation that occurs during computer operation.

Such data collection is a complex technical task and requires the involvement of qualified specialists. With the help of a receiving device based on a standard TV, it is possible to intercept information displayed on computer screens from a distance of a thousand or more meters. Certain information about the operation of a computer system is retrieved even when the communication process is monitored without access to their content.

Threats to the integrity of data, programs, hardware. The integrity of data and programs is violated by unauthorized destruction, adding unnecessary elements and modifying account records, changing the order of data arrangement, generating falsified payment documents in response to legitimate requests, with active relaying of messages with their delay.

Unauthorized modification of system security information can lead to unauthorized actions (incorrect routing or loss of transmitted data) or distortion of the meaning of transmitted messages. The integrity of the equipment is violated when it is damaged, stolen or illegally changed the operation algorithms.

Threats to data availability. They occur when an object (user or process) does not get access to the services or resources legally allocated to it. This threat is implemented by capturing all resources, blocking communication lines by an unauthorized object as a result of transmitting its information through them, or excluding the necessary system information.

This threat can lead to unreliability or poor quality of service in the system and, therefore, will potentially affect the reliability and timeliness of delivery of payment documents.

– Threats to refuse transactions. They arise when a legal user sends or accepts payment documents, and then denies this in order to relieve himself of responsibility.

Assessing the vulnerability of an automated information system and building an impact model involves studying all the options for implementing the above threats and identifying the consequences they lead to.

Threats may be due to:

- natural factors (natural disasters - fire, flood, hurricane, lightning and other causes);

- human factors, which in turn are divided into:

passive threats(threats caused by activities of an accidental, unintentional nature). These are threats associated with errors in the process of preparing, processing and transmitting information (scientific and technical, commercial, monetary and financial documentation); with untargeted "brain drain", knowledge, information (for example, in connection with the migration of the population, travel to other countries for family reunification, etc.);

active threats(threats caused by intentional, deliberate actions of people). These are threats related to the transfer, distortion and destruction of scientific discoveries, inventions, production secrets, new technologies for selfish and other anti-social motives (documentation, drawings, descriptions of discoveries and inventions, and other materials); viewing and transferring various documentation, viewing "garbage"; eavesdropping and transmission of official and other scientific, technical and commercial conversations; with a purposeful "brain drain", knowledge, information (for example, in connection with obtaining another citizenship for mercenary motives);

- human-machine and machine factors, subdivided into:

passive threats. These are threats associated with errors in the process of designing, developing and manufacturing systems and their components (buildings, structures, premises, computers, communications, operating systems, application programs, etc.); with errors in the operation of the equipment due to poor-quality manufacturing; with errors in the process of preparing and processing information (errors of programmers and users due to insufficient qualifications and poor quality service, operator errors in preparing, entering and outputting data, correcting and processing information);

active threats. These are threats associated with unauthorized access to the resources of an automated information system (introducing technical changes to computer equipment and communication equipment, connecting to computer equipment and communication channels, stealing various types of information media: floppy disks, descriptions, printouts and other materials, viewing input data, printouts, viewing "garbage"); threats implemented in a non-contact way (collection of electromagnetic radiation, interception of signals induced in circuits (conductive communications), visual-optical methods of extracting information, eavesdropping on official and scientific and technical conversations, etc.).

The main typical ways of information leakage and unauthorized access to automated information systems, including through telecommunication channels, are the following:

interception of electronic radiation;

the use of listening devices (bookmarks);

remote photography;

interception of acoustic radiation and restoration of the text of the printer;

theft of storage media and industrial waste;

reading data in arrays of other users;

reading residual information in the system memory after the execution of authorized requests;

copying of information carriers with overcoming protection measures;

disguise as a registered user;

mystification (disguise under system requests);

illegal connection to equipment and communication lines;

malicious incapacitation of protection mechanisms;

use of "software traps".

Possible channels of intentional unauthorized access to information in the absence of protection in an automated information system can be:

regular channels of access to information (user terminals, means of displaying and documenting information, storage media, software download tools, external communication channels) in case of their illegal use;

technological consoles and controls;

internal installation of equipment;

communication lines between hardware;

spurious electromagnetic radiation carrying information;

side pickups on power supply circuits, equipment grounding, auxiliary and extraneous communications located near the computer system.

Ways of impact of threats on information security objects are divided into information, software and mathematical, physical, radio-electronic and organizational and legal.

Information methods include:

violation of the targeting and timeliness of information exchange, illegal collection and use of information;

unauthorized access to information resources;

manipulation of information (disinformation, concealment or distortion of information);

illegal copying of data in information systems;

violation of information processing technology.

Programmatic mathematical methods include:

introduction of computer viruses;

installation of software and hardware embedded devices;

destruction or modification of data in automated information systems.

Physical methods include:

destruction or destruction of information processing and communication facilities;

destruction, destruction or theft of machine or other original storage media;

theft of software or hardware keys and means of cryptographic information protection;

impact on staff;

supply of "infected" components of automated information systems.

Electronic methods are:

interception of information in technical channels its possible leakage;

implementation electronic devices interception of information in technical means and premises;

interception, decryption and imposition of false information in data transmission networks and communication lines;

impact on password-key systems;

electronic suppression of communication lines and control systems.

Organizational and legal methods include:

non-compliance with legal requirements and delays in adopting the necessary legal and regulatory provisions in the information sphere;

unlawful restriction of access to documents containing important information for citizens and organizations.

Software security threats. Ensuring the security of automated information systems depends on the security of the software used in them and, in particular, the following types of programs:

regular user programs;

special programs designed to violate the security of the system;

varied system utilities and commercial application programs, which have a high professional level of development and yet may contain individual flaws that allow invaders to attack systems.

Programs can create two types of problems: firstly, they can intercept and modify data as a result of the actions of a user who does not have access to this data, and secondly, using omissions in the protection of computer systems, they can either provide access to the system to users, unauthorized, or block legitimate users from accessing the system.

The higher the programmer's level of training, the more implicit (even for him) the mistakes he makes become, and the more carefully and reliably he is able to hide the deliberate mechanisms designed to compromise the security of the system.

Programs themselves can be the target of an attack for the following reasons:

In today's world, software can be a highly profitable commodity, especially to the first person to commercialize and copyright the software.

Programs can also become the object of an attack aimed at modifying these programs in some way, which would allow in the future to attack other objects in the system. Especially often, programs that implement system protection functions become the object of attacks of this kind.

Let's look at several types of programs and techniques that are most often used to attack programs and data. These techniques are denoted by a single term - "software traps". These include software hatches, Trojan horses, logic bombs, salami attacks, covert channels, denial of service, and computer viruses.

Hatches in programs. The use of hatches to infiltrate a program is one of the simplest and most commonly used ways to breach the security of automated information systems.

Luke is the ability to work with this software product not described in the documentation for the software product. The essence of using hatches is that when the user performs some actions not described in the documentation, he gets access to features and data that are normally closed to him (in particular, access to privileged mode).

Hatches are most often the result of developer forgetfulness. As a hatch, a temporary mechanism for direct access to parts of the product, created to facilitate the debugging process and not removed after it, can be used. Hatches can also be formed as a result of the often practiced “top-down” software development technology: their role will be played by “stubs” left for some reason in the finished product - groups of commands that imitate or simply indicate the connection point for future subroutines.

Finally, another common source of hatches is the so-called "undefined input" - the input of "meaningless" information, gibberish in response to system requests. The reaction of a poorly written program to undefined input can be, at best, unpredictable (when the program reacts differently each time the same wrong command is entered again); much worse, if the program performs some repetitive actions as a result of the same "undefined" input - this gives the potential invader the opportunity to plan his actions to violate security.

Undefined input is a private implementation of the interrupt. That is, in the general case, the invader can deliberately create some non-standard situation in the system that would allow him to perform the necessary actions. For example, it can artificially crash a program running in privileged mode in order to take control by remaining in that privileged mode.

The fight against the possibility of interruption, ultimately, results in the need to provide for the development of programs for a set of mechanisms that form the so-called "fool protection". The meaning of this protection is to ensure that any possibility of processing undefined input and various non-standard situations (in particular, errors) is guaranteed to be cut off and thus prevent violation of the security of the computer system even in the event of incorrect operation with the program.

Thus, a hatch (or hatches) may be present in a program because the programmer:

forgot to delete it;

deliberately left it in the program to provide testing or to perform the rest of the debugging;

deliberately left it in the program in the interests of facilitating final assembly final software product;

deliberately left it in the program in order to have a hidden means of access to the program after it became part of the final product.

The hatch is the first step to attacking the system, the ability to penetrate the computer system bypassing the protection mechanisms.

"Trojan horses".

There are programs that implement, in addition to the functions described in the documentation, some other functions that are not described in the documentation. Such programs are called Trojan horses.

The probability of detecting a "Trojan horse" is higher, the more obvious the results of its actions (for example, deleting files or changing their protection). More sophisticated "Trojan horses" can mask the traces of their activity (for example, restore file protection to its original state).

"Logic bombs".

A "logic bomb" is usually called a program or even a piece of code in a program that implements some function when a certain condition is met. This condition can be, for example, the occurrence of a certain date or the discovery of a file with a certain name.

When exploding, the "logic bomb" implements a function that is unexpected and, as a rule, undesirable for the user (for example, it deletes some data or destroys some system structures). The "logic bomb" is one of the favorite ways for programmers to take revenge on companies that fired them or offended them in some way.

Salami attack.

The salami attack has become a real scourge of banking computer systems. Thousands of transactions related to non-cash payments, transfers of amounts, deductions, etc. are performed daily in banking systems.

When processing invoices, whole units (rubles, cents) are used, and when calculating interest, fractional amounts are often obtained. Typically, values greater than half a ruble (cent) are rounded up to the nearest whole ruble (cent), while values less than half a ruble (cent) are simply discarded. When attacking "salami" these insignificant values are not removed, but are gradually accumulated on some special account.

As practice shows, the amount, made up literally from nothing, for a couple of years of operation of the “cunning” program in an average bank can amount to thousands of dollars. Salami attacks are quite difficult to recognize unless the attacker starts accumulating large sums in one account.

Hidden channels.

Covert channels are programs that transmit information to persons who, under normal conditions, should not receive this information.

In those systems where critical information is processed, the programmer should not have access to the data processed by the program after the start of operation of this program.

From the fact of possessing some proprietary information, you can derive considerable benefit, at least elementarily by selling this information (for example, a list of customers) to a competing firm. A sufficiently skilled programmer can always find a way to covertly communicate information; however, a program designed to create the most innocuous reports can be a little more complicated than the task requires.

For hidden transmission of information, you can successfully use various elements of the format of "harmless" reports, for example, different line lengths, gaps between lines, the presence or absence of service headers, controlled output of insignificant digits in output values, the number of spaces or other characters in certain places of the report, etc. d.

If the invader has the ability to access the computer while the program of interest is running, the covert channel can be the transfer of critical information to a data array specially created in the computer's RAM.

Hidden channels are most applicable in situations where the invader is not even interested in the content of information, but, for example, in the fact of its presence (for example, the presence of a bank account with a certain number).

Denial of service.

Most security breaches are aimed at gaining access to data that is not normally allowed by the system. However, no less interesting for the invaders is access to the control of the computer system itself or changing its qualitative characteristics, for example, to get some resource (processor, input-output device) for exclusive use or to provoke a clinch situation for several processes.

This may be required in order to explicitly use the computer system for your own purposes (at least for free solution tasks) or simply block the system, making it inaccessible to other users. This type of system security breach is called a “denial of service” or “denial of service.” "Denial of service" is extremely dangerous for real-time systems - systems that control some technological processes, perform various kinds of synchronization, etc.

Computer viruses.

Computer viruses are the quintessence of all sorts of security breach methods. One of the most common and favorite methods of spreading viruses is the "Trojan horse" method. Viruses differ from "logic bombs" only in their ability to replicate and provide their own launch, so many viruses can be considered a special form of "logic bombs".

To attack the system, viruses actively use all sorts of “hatchways”. Viruses can implement a wide variety of dirty tricks, including the salami attack. In addition, the success of an attack of one type often contributes to a decrease in the "immunity" of the system, creates a favorable environment for the success of attacks of other types. The invaders know this and actively use this circumstance.

Of course, in its pure form, the techniques described above are quite rare. Much more often during the attack, separate elements of different techniques are used.

Information threats in computer networks. Networks of computers have many advantages over a set of separately operating computers, including: sharing of system resources, increasing the reliability of the system, distributing the load among network nodes, and expandability by adding new nodes.

However, when using computer networks, there are serious problems of information security. The following can be noted.

Separation of shared resources.

Due to the sharing of a large number of resources by various network users, possibly located at a great distance from each other, the risk of unauthorized access is greatly increased, since it can be carried out more easily and discreetly on the network.

Expansion of the zone of control.

The administrator or operator of a particular system or subnetwork must monitor the activities of users who are out of his reach.

A combination of various software and hardware.

The connection of several systems in a network increases the vulnerability of the entire system as a whole, since each information system is configured to fulfill its own specific security requirements, which may be incompatible with the requirements on other systems.

Unknown parameter.

The easy extensibility of networks leads to the fact that it is sometimes difficult to determine the boundaries of a network, since the same node can be available to users of different networks. Moreover, for many of them it is not always possible to determine exactly how many users have access to a particular network node and who they are.

Lots of attack points.

In networks, the same set of data or message can be transmitted through several intermediate nodes, each of which is a potential source of threat. In addition, many modern networks can be accessed using dial-up lines and a modem, which greatly increases the number of possible attack points.

The complexity of managing and controlling access to the system.

Many attacks on a network can be carried out without gaining physical access to a specific host - using a network from remote points.

In this case, the identification of the intruder can be very difficult. In addition, the attack time may be too short to take adequate measures.

On the one hand, the network is a single system with uniform information processing rules, and on the other hand, it is a collection of separate systems, each of which has its own information processing rules. Therefore, taking into account the dual nature of the network, an attack on the network can be carried out from two levels: upper and lower (their combination is also possible).

In a high-level attack on a network, an attacker uses the properties of the network to infiltrate another host and perform certain unauthorized actions. At the low level of attack on the network, the attacker uses the properties network protocols to violate the confidentiality or integrity of individual messages or the stream as a whole.

Disruption of message flow can lead to information leakage and even loss of control over the network.

Distinguish between passive and active low-level threats specific to networks.

Passive Threats

(violation of the confidentiality of data circulating in the network) is the viewing and / or recording of data transmitted over communication lines. These include:

viewing a message;

graph analysis - an attacker can view the headers of packets circulating in the network and, based on the service information contained in them, draw conclusions about the senders and recipients of the packet and the transmission conditions (time of departure, message class, security category, message length, traffic volume, etc.) .).

Active Threats

(violation of the integrity or availability of resources and network components) - unauthorized use of devices that have access to the network to change individual messages or a message flow. These include:

failure of messaging services - an attacker can destroy or delay individual messages or the entire flow of messages;

"masquerade" - an attacker can assign someone else's identifier to his node or relay and receive or send messages on someone else's behalf;

introduction of network viruses - transmission of a virus body over a network with its subsequent activation by a user of a remote or local host;

message flow modification - an attacker can selectively destroy, modify, delay, reorder and duplicate messages, as well as insert fake messages.

Threats to commercial information.

Under the conditions of informatization, such methods of unauthorized access to confidential information as copying, forgery, destruction are also of particular danger.

Copy.

In case of unauthorized access to confidential information, they copy: documents containing information of interest to the attacker; technical media; information processed in automated information systems. The following copying methods are used: blueprinting, photocopying, thermal copying, photocopying and electronic copying.

Fake.

In a competitive environment, forgery, modification and imitation are on a large scale. Malefactors forge confidential documents allowing to receive certain information, letters, accounts, accounting and financial documentation; forge keys, passes, passwords, ciphers, etc. In automated information systems, forgery includes, in particular, such malicious actions as falsification (the recipient subscriber forges the received message, passing it off as valid in his own interests), masking (the subscriber - the sender disguises himself as another subscriber in order to receive protected information).

Destruction.

Of particular danger is the destruction of information in automated databases and knowledge bases. Information on magnetic media is destroyed with the help of compact magnets and programmatically (“logical bombs”). A significant place in crimes against automated information systems is occupied by sabotage, explosions, destruction, failure of connecting cables, air conditioning systems.

Methods and means of ensuring information security of an organization (firm)

The methods for ensuring information security are as follows: obstacle, access control, masking, regulation, coercion and inducement.

Obstacle - a method of physically blocking an attacker's path to protected information (to equipment, storage media, etc.).

Access control- a method of protecting information by regulating the use of all resources of an automated information system of an organization (firm). Access control includes the following security features:

identification of users, personnel and resources of the information system (assignment of a personal identifier to each object);

authentication (authentication) of an object or subject by the identifier presented to them;

verification of authority (checking the compliance of the day of the week, time of day, requested resources and procedures with the established regulations);

permission and creation of working conditions within the established regulations;

registration (logging) of calls to protected resources;

response (alarm, shutdown, work delay, request denied) in case of attempts of unauthorized actions.

disguise - a method of protecting information in an automated information system by means of its cryptographic closure.

Regulation- a method of information protection that creates such conditions for automated processing, storage and transmission of information under which the possibility of unauthorized access to it would be minimized.

Coercion - this method of information protection, in which users and system personnel are forced to comply with the rules for processing, transferring and using protected information under the threat of material, administrative or criminal liability.

Motivation - such a method of information protection that encourages users and system personnel not to violate established rules by complying with established moral and ethical standards.

The above methods for ensuring the information security of an organization (firm) are implemented in practice by using various protection mechanisms, for the creation of which the following main means are used: physical, hardware, software, hardware-software, cryptographic, organizational, legislative and moral and ethical.

Physical protections designed for external protection of the territory of objects, protection of the components of the automated information system of the enterprise and are implemented in the form of autonomous devices and systems.

Along with traditional mechanical systems with the dominant participation of a person, universal automated electronic systems of physical protection are being developed and implemented, designed to protect territories, protect premises, organize access control, organize surveillance; fire alarm systems; media theft prevention systems.

The element base of such systems is made up of various sensors, the signals from which are processed by microprocessors, electronic smart keys, devices for determining human biometric characteristics, etc.

To organize the protection of equipment that is part of the automated information system of the enterprise, and movable media (floppy disks, magnetic tapes, printouts), the following are used:

various locks (mechanical, coded, microprocessor-controlled, radio-controlled) that are installed on entrance doors, shutters, safes, cabinets, devices and system blocks;

microswitches that detect the opening or closing of doors and windows;

inertial sensors, which can be connected to the lighting network, telephone wires and wiring of television antennas;

special foil stickers that are pasted on all documents, devices, components and units of the system to prevent their removal from the premises. At any attempt to take an object with a sticker outside the premises, a special installation (analogue of a metal object detector) located near the exit sounds an alarm;

special safes and metal cabinets for installing individual elements of an automated information system (file server, printer, etc.) and movable storage media in them.

To neutralize information leakage through electromagnetic channels, shielding and absorbing materials and products are used. Wherein:

shielding of working premises where components of an automated information system are installed is carried out by covering the walls, floor and ceiling with metallized wallpaper, conductive enamel and plaster, wire mesh or foil, installing fences made of conductive bricks, multilayer steel, aluminum or special plastic sheets;

metallized curtains and glass with a conductive layer are used to protect windows;

all openings are covered with a metal mesh connected to the ground bus or wall shielding;

limiting magnetic traps are mounted on the ventilation ducts to prevent the propagation of radio waves.

To protect against pickups on the electrical circuits of nodes and blocks of an automated information system, the following are used:

shielded cable for intra-rack, intra-unit, inter-unit and outdoor installation;

shielded elastic connectors (sockets), surge suppression filters for electromagnetic radiation;

wires, tips, chokes, capacitors and other interference-suppressing radio and electrical products;

separating dielectric inserts are placed on water, heating, gas and other metal pipes, which break the electromagnetic circuit.

To control the power supply, electronic trackers are used - devices that are installed at the input points of the AC voltage network. If the power cord is cut, broken, or burnt out, the coded message triggers an alarm or activates a television camera to record the events.

An X-ray examination is considered the most effective for detecting embedded "bugs". However, the implementation of this method is associated with great organizational and technical difficulties.

The use of special noise generators to protect against theft of information from computers by removing its radiation from display screens has an adverse effect on the human body, which leads to rapid baldness, loss of appetite, headaches, and nausea. That is why they are rarely used in practice.

Hardware protections - these are various electronic, electromechanical and other devices directly built into the blocks of an automated information system or designed as independent devices and interfaced with these blocks.

They are designed for internal protection of structural elements of computer equipment and systems: terminals, processors, peripheral equipment, communication lines, etc.

The main functions of hardware protection:

prohibition of unauthorized internal access to individual files or databases of the information system, possible as a result of accidental or intentional actions of service personnel;

protection of active and passive (archival) files and databases associated with non-maintenance or shutdown of an automated information system;

software integrity protection.

These tasks are implemented by information security hardware using the access control method (identification, authentication and verification of the authority of system subjects, registration and response).

To work with especially valuable information, organizations (firms) computer manufacturers can produce individual disks with unique physical characteristics that do not allow reading information. At the same time, the cost of a computer can increase several times.

Software protections designed to perform logical and intellectual protection functions and are included either in the software of an automated information system, or in the tools, complexes and systems of control equipment.

Information protection software is the most common type of protection, having the following positive properties: versatility, flexibility, ease of implementation, the possibility of change and development. This circumstance makes them at the same time the most vulnerable elements of the protection of the enterprise information system.

Currently, a large number of operating systems, database management systems, network packages and application software packages have been created, including a variety of information protection tools.

With the help of software protection tools, the following information security tasks are solved:

control of loading and logging into the system using personal identifiers (name, code, password, etc.);

differentiation and control of access of subjects to resources and components of the system, external resources;

isolation of process programs performed in the interests of a particular subject from other subjects (ensuring the work of each user in an individual environment);

managing the flow of confidential information in order to prevent recording on data carriers of an inappropriate level (label) of secrecy;

protection of information from computer viruses;

deletion of residual confidential information in the fields of the computer's RAM that were unlocked after the execution of requests;

deletion of residual confidential information on magnetic disks, issuance of protocols on the results of deletion;

ensuring the integrity of information by introducing data redundancy;

automatic control over the work of system users based on the results of logging and preparation of reports based on entries in the system log.

Currently, a number of operating systems initially contain built-in means of blocking "reuse". For other types of operating systems, there are quite a lot of commercial programs, not to mention special security packages that implement similar functions.

The use of redundant data is aimed at preventing the occurrence of random errors in the data and the detection of unauthorized modifications. This can be the use of checksums, data control for even-odd, error-correcting coding, etc.

It is often practiced to store signatures of important system objects in some secure place in the system. For example, for a file, a combination of the file's security byte with its name, length, and date of last modification can be used as a signature. Each time a file is accessed, or in case of suspicion, the current characteristics of the file are compared with a benchmark.

The auditability property of an access control system means the possibility of reconstructing events or procedures. The auditability tools need to find out what actually happened. This includes documenting the procedures performed, keeping logs, and applying clear and unambiguous methods of identification and verification.

It should be noted that the task of access control while ensuring the integrity of resources is reliably solved only by encryption of information.

When we talk about a threat to information security, as a rule, we imagine an experienced hacker, scrupulously studying the slightest gaps in database protection day and night. However, as practice shows, often the trouble comes from within the company - through an oversight, or through malicious intent, confidential information leaks precisely through the employees of the organization.

A number of serious specialists in information security of the organization calls the internal threat the most important, giving it up to 80% of the total number of potential risks. Indeed, if we consider the average damage from hacker attacks, then it will be close to zero, due to the large number of hacking attempts and their very low effectiveness. A single case of human error or a successful insider misdeed can cost the company millions in losses (direct and indirect), litigation and notoriety in the eyes of customers. In fact, the very existence of the company may be threatened, and this, alas, is a reality. How to ensure ? How to protect yourself from information leaks? How to recognize and prevent an internal threat in time? What methods of dealing with it are most effective today?

Enemy within

Almost any employee who has access to confidential company information can become an internal attacker, or insider. The motivation of an insider's actions is not always obvious, which entails significant difficulties in identifying him. A recently fired employee who harbors a grudge against the employer; a dishonest employee who wants to earn extra money by selling data; modern Herostratus; a specially implanted agent of a competitor or a criminal group - these are just a few archetypes of an insider.

The root of all the ills that insider malice can bring is the underestimation of the importance of this threat. According to a study conducted by Perimetrix, the leakage of more than 20% of a company's confidential information in most cases leads to its collapse and bankruptcy. An especially frequent, but still the most vulnerable victim of insiders are financial institutions, and of any size - with a staff of hundreds to several thousand employees. Despite the fact that in most cases companies try to hide or significantly underestimate the real figures of damage from insider actions, even the officially announced losses are truly impressive. Much more painful than financial losses for the company is the damage to the company's reputation and a sharp decline in customer confidence. Often, indirect losses can many times exceed the actual direct damage. Thus, the case of the Liechtenstein bank LGT is widely known, when in 2008 a bank employee handed over a database of depositors to the special services of Germany, the USA, Great Britain and other countries. As it turned out, a huge number of foreign clients of the bank used the special status of LGT to conduct transactions bypassing the tax laws in their countries. A wave of financial investigations and related litigation swept the world, and LGT lost all its significant clients, suffered critical losses and plunged the whole of Liechtenstein into a severe economic and diplomatic crisis. You don't need to look far for very fresh examples either - in early 2011, such a financial giant as Bank of America admitted the fact of a leak of customer personal data. As a result of fraudulent activities, information was leaked from the bank with names, addresses, social security and telephone numbers, bank account and driver's license numbers, addresses Email, PIN codes and other personal data of contributors. It is hardly possible to accurately determine the real scale of the bank's losses, if only the amount "more than 10 million dollars" was officially announced. The reason for the data leak is the actions of an insider who passed information to an organized criminal group. However, under the threat of insider attacks, not only banks and funds, it will be enough to recall a number of high-profile scandals related to the publication of confidential data on the WikiLeaks resource - according to experts, a fair amount of information was obtained through insiders.

prose of life

Unintentional harm to company confidential data, its leakage or loss is a much more frequent and prosaic thing than the harm caused by insiders. The carelessness of the staff and the lack of proper technical information security can lead to a direct leak of corporate secrets. Such negligence not only causes serious losses to the budget and reputation of the company, but can also cause widespread public dissonance. Having broken free, secret information becomes the property not of a narrow circle of intruders, but of the entire information space - the leak is discussed on the Internet, on television, in the press. Let's remember the high-profile scandal with the publication of SMS-messages of the largest Russian mobile operator MegaFon. Due to the inattention of technical personnel, SMS messages were indexed by Internet search engines, and subscribers' correspondence containing information of both personal and business nature got into the network. A very recent case: the publication of personal data of clients of the Pension Fund of Russia. The error of representatives of one of the regional representative offices of the fund led to the indexing of personal information of 600 people - names, registration numbers, detailed amounts of savings of PFR clients could be read by any Internet user.

A very common cause of confidential data leaks due to negligence is related to the daily rotation of documents within the company. So, for example, an employee can copy a file containing sensitive data to a laptop computer, USB stick or PDA to work with data outside the office. Also, information can get on a file hosting service or personal mail worker. In such situations, the data is completely defenseless for attackers who can take advantage of an unintentional leak.

Golden armor or body armor?

To protect against data leakage in the information security industry, various systems for protecting information from leakage are being created, traditionally denoted by the abbreviation DLP from English. Data Leakage Prevention ("prevention of data leakage"). As a rule, these are the most complex software systems with wide functionality to prevent malicious or accidental leakage of secret information. A feature of such systems is that their correct operation requires a well-established structure of the internal circulation of information and documents, since the security analysis of all actions with information is based on working with databases. This explains high price installation of professional DLP solutions: even before direct implementation, the client company has to purchase a database management system (usually Oracle or SQL), order an expensive analysis and audit of the information circulation structure, and develop a new security policy. A common situation is when more than 80% of information is unstructured in a company, which gives a visual idea of the scale of preparatory activities. Of course, the DLP system itself also costs a lot of money. Not surprisingly, only large companies willing to spend millions on information security of the organization.

But what about small and medium-sized businesses that need to provide business information security, but there are no funds and opportunities to implement a professional DLP system? The most important thing for a company executive or security officer is to determine what information to protect and which parties information activities employees to be supervised. In Russian business, the opinion still prevails that absolutely everything needs to be protected, without classifying information and calculating the effectiveness of protection measures. With this approach, it is quite obvious that having learned the amount of expenses for enterprise information security, the head of medium and small business waves his hand and hopes for "maybe".

Exist alternative ways protections that do not affect databases and the established life cycle of information, but provide reliable protection against the actions of intruders and negligence of employees. These are flexible modular complexes that work without problems with other security tools, both hardware and software (for example, with antiviruses). A well-designed security system provides very reliable protection against both external and internal threats, providing an ideal balance of price and functionality. According to the specialists of the Russian company-developer of information security systems SafenSoft, the optimal combination of elements of protection against external threats (for example, HIPS for intrusion prevention, plus virus scanner) with means of monitoring and controlling the access of users and applications to certain sectors of information. With this approach, the entire network structure of the organization is completely protected from possible hacking or infection with viruses, and the means of monitoring and monitoring the actions of personnel when working with information can effectively prevent data leaks. With all the necessary arsenal of protective equipment, the cost of modular systems is ten times less than complex DLP solutions and does not require any costs for preliminary analysis and adaptation of the company's information structure.

So, let's sum up. Threats enterprise information security quite real, they should not be underestimated. In addition to counteracting external threats, special attention should be paid to internal threats. It is important to remember that leaks of corporate secrets happen not only due to malicious intent - as a rule, they are caused by elementary negligence and inattention of an employee. When choosing means of protection, one should not try to cover all conceivable and unthinkable threats, there simply will not be enough money and strength for this. Build a reliable modular security system that is closed from the risks of intrusion from the outside and allows you to control and monitor the flow of information within the company.

Information security of an enterprise is a state of security of corporate data, which ensures their confidentiality, integrity, authenticity and availability.

Information security of an enterprise is achieved by a whole range of organizational and technical measures aimed at protecting corporate data. Organizational measures include documented procedures and rules for working with different types of information, IT services, security tools, etc. Technical measures include the use of hardware and software access control, leak monitoring, anti-virus protection, firewalling, protection against electromagnetic radiation, and so on.

The tasks of enterprise information security systems are diverse. This is the provision of secure storage of information on different media; protection of data transmitted over communication channels; differentiation of access to various types of documents; Creation backups, post-accident recovery of information systems, etc.

Ensuring the information security of an enterprise is possible only with a systematic and integrated approach to protection. The information security system must take into account all current computer threats and vulnerabilities.

Full-fledged information security of enterprises and organizations implies continuous real-time monitoring of all important events and conditions that affect data security. Protection should be carried out around the clock and all year round and cover the entire life cycle of information - from its receipt or creation to destruction or loss of relevance.

At the enterprise level, information security departments are responsible for information technology, economic security, human resources and other departments.

03.12.2021

Computer

The most interesting:

Label each polygon and measure the side lengths of each.

Connect YouTube to TV

Names of large numbers Solution of a compound problem