An enterprise established to improve the efficiency, resilience, and reliability of centralized cold-water supply and wastewater systems, improve the quality of service to customers, increase the reliability of service delivery, and generate profit.

Conditions
Due to the absence of information-security specialists and changes or new requirements in legislation on the protection of significant critical-information-infrastructure facilities, the client requested assistance in determining whether the enterprise is a critical-information-infrastructure entity and in developing organizational and administrative documentation for categorization.

Tasks
1. Determine whether the enterprise is a critical-information-infrastructure entity.
2. Determine whether the enterprise falls under Presidential Decree No. 250 of the Russian Federation, dated May 1, 2022.
3. The information-security department does not consider the SCADA system and laboratory analyzers to be CII facilities. Provide justification and clarification, and develop organizational and administrative documentation for categorization if the answers are positive.

Solution
To determine the enterprise’s status as a CII entity and justify whether it falls under Presidential Decree No. 250, the following actions are required:
1. Conduct an on-site inspection, including interviews with employees of various departments at all informatization facilities of the enterprise. Collect information about critical processes related to the enterprise’s main functions and activities.
2. Identify CII facilities that support critical processes. Collect information about their purpose, architecture, software and hardware-software tools used, interaction with other CII facilities, and access characteristics for communication networks.

Result

• The enterprise’s status as a CII entity was determined.
• A categorization commission was appointed, with recommendations provided on its composition.
• Critical processes and CII facilities supporting those processes were identified.
• Categorization of significant CII facilities was carried out, and an up-to-date set of organizational and administrative documentation on CII-facility categorization was developed.
• Recommendations were provided on further actions regarding organizational and administrative documentation and reporting to regulators.
• Justification and recommendations were provided regarding whether the enterprise falls under Presidential Decree No. 250 of the Russian Federation.

A large medical institution including a 500-bed hospital, an interdistrict primary vascular center and a second-level trauma center, a children’s polyclinic, an adult polyclinic, a women’s health clinic, an ambulance station, a physiotherapy department, an HIV laboratory, a blood-transfusion department, first-aid stations and district hospitals in rural settlements of the Labinsky District, as well as other services and departments.

Conditions
Due to the absence of in-house information-security staff, requirements from the Ministry of Health of Krasnodar Krai, and regulators in the field of CII protection, the client requested assistance with categorization of CII facilities.

Task
What are the CII facilities in healthcare institutions? Identify these facilities and carry out the categorization procedure.

Solution
1. Conduct an on-site inspection, including interviews with employees to collect information about critical processes in the performance of the institution’s functions, including management, technological, production, financial and economic, and other processes.
2. Collect information about CII facilities that support critical processes, including their purpose, architecture, software and hardware-software tools used, interaction with other CII facilities, and access to communication networks.
3. Carry out categorization of CII facilities.

Result

• A categorization commission was appointed, with recommendations provided on its composition.
• CII facilities were identified and assigned categories; the highest assigned category was category three.
• Organizational and administrative documentation was developed for categorization of CII facilities.
• Recommendations were provided on further actions regarding organizational and administrative documentation and reporting to regulators.

Conditions
Due to the lack of in-house information-security expertise and changes in personal-data protection legislation, the client requested assistance in updating organizational and administrative documentation regulating personal-data processing. Particular emphasis was placed on interaction with GosSOPKA (the state system for detecting, preventing, and mitigating the consequences of computer attacks on information resources of the Russian Federation) and third-party information systems.

Task
Bring all personal-data processing processes, organizational and administrative documentation, and information-security threat models into compliance with personal-data protection legislation.

Solution
To ensure compliance with legislation on the protection of all personal-data processing processes, organizational and administrative documentation, and information-security threat models, the following actions are required as part of an on-site inspection and interviews with the client’s employees:
1. Identify all personal-data processing processes, both automated and non-automated.
2. Identify and define all information systems, including personal-data information systems and state information systems, in which personal data is processed, followed by classification and definition of protective measures.
3. Determine the specifics of non-automated personal-data processing performed without the use of computing equipment.
4. Identify violations of legislative requirements.
5. Collect information about the technical means involved in personal-data processing and the network architecture.
6. Collect information about existing and used information-protection tools.
7. Identify current information-security threats.

Result
• Information-security measures were completed.
• An up-to-date set of organizational and administrative documentation regulating personal-data processing was developed, including threat models, attacker models, and all documents required for reporting to Roskomnadzor.
• A report was prepared based on the inspection results, including recommendations for eliminating non-compliance with personal-data protection legislation and initial data for the further creation, development, design, and implementation of a protection system for facilities involved in personal-data processing.

A medical institution providing examinations and treatment for adults and children across all areas.

Conditions
The absence of an in-house information-security specialist and the complete absence of up-to-date personal-data protection documentation for two legal entities of the company.

Task
Bring all personal-data processing processes into compliance with personal-data protection legislation, identify personal-data information systems, and develop organizational and administrative documentation and information-security threat models.

Solution
Using an on-site inspection and interviews with the client’s employees, the following actions must be performed:
1. Identify all personal-data processing processes, both automated and non-automated.
2. Identify and define all information systems, including personal-data information systems and state information systems, in which personal data is processed, with classification and definition of protective measures.
3. Determine the specifics of non-automated personal-data processing performed without the use of computing equipment.
4. Identify violations of legislative requirements.
5. Collect information about the technical means and network architecture used in personal-data processing.
6. Collect information about the information-protection tools used and available.
7. Identify current information-security threats.

Result

• Information-security measures were completed.
• An up-to-date set of organizational and administrative documentation regulating personal-data processing was developed, including threat models, attacker models, and all documents required for reporting to Roskomnadzor.
• Recommendations were prepared for eliminating non-compliance with personal-data protection legislation.

One of the country’s largest multidisciplinary medical institutions providing specialized medical care, combining a diagnostic and advisory center and more than 40 departments.

Conditions
Due to the lack of in-house information-security expertise, changes in personal-data protection legislation, and requirements from the Federal Medical-Biological Agency of Russia, the client requested assistance in developing an up-to-date set of organizational and administrative documentation regulating personal-data processing, as well as in applying technical measures to organize the protection of communication channels.

Task
Bring all personal-data processing processes into compliance with personal-data protection legislation, identify personal-data information systems, and develop an up-to-date set of organizational and administrative documentation and information-security threat models.

Solution
Using an on-site inspection and interviews with the client’s employees, the following actions must be performed:
1. Identify all personal-data processing processes, both automated and non-automated.
2. Identify information systems, including personal-data information systems and state information systems, in which personal data is processed, with classification and definition of protective measures.
3. Determine the specifics of non-automated personal-data processing performed without the use of computing equipment.
4. Identify violations of legislative requirements.
5. Collect information about the technical means and network architecture involved in personal-data processing.
6. Collect information about existing and used information-protection tools.
7. Identify current information-security threats.

Result
Information-security measures were completed.

• An up-to-date set of organizational and administrative documentation regulating personal-data processing was developed, including threat models, attacker models, and all documents required for reporting to Roskomnadzor.
• Recommendations were prepared for eliminating non-compliance with personal-data protection legislation.

An enterprise with a full technological production cycle for air conditioners, fans, and other climate-control equipment. Its products are used on oil platforms and nuclear power plants, in the Kremlin and at sports stadiums, in factories and on ships, in hospitals, and in the metro.

Conditions
Dismissal of a key employee and unfinished infrastructure-modernization tasks.

Task
Check the infrastructure for backdoors; conduct an unplanned password-change procedure. Obtain an independent, objective assessment of the state of the IT infrastructure.

Solution
1. Interview employees responsible for the network infrastructure.
2. Conduct a technical inventory of server and network equipment.
3. Inventory the composition of system and application software, taking versions into account.
4. Analyze the configurations of the software used.
5. Assess the current performance and resource consumption of server equipment.
6. Analyze system logs.
7. Analyze access lists for servers, system software, and application software, and prepare proposals for changing them.
8. Change credentials and passwords for local accounts based on prior agreement and information received from the customer.

Result
Information-security measures were completed. A report on the state of the infrastructure was prepared, and potential problem areas were identified.

The company’s main activity is geological exploration, geophysical, and geochemical work in the study of subsoil resources and the reproduction of the mineral-resource base. The company also operates in three other areas.

Conditions
The facility is a critical-information-infrastructure facility; compliance with regulator requirements is necessary.

Task
Obtain an objective assessment of the state of the IT infrastructure and recommendations for building an information-security system.

Solution
• Conduct a technical inventory of server and network equipment.
• Inventory the composition of system and application software, taking versions into account.
• Analyze the configurations of the software used.
• Assess the current performance and resource consumption of server equipment.
• Analyze access lists for servers, system software, and application software, and prepare proposals for changing them.

Result
A report was prepared on the current state of the information infrastructure. A roadmap was designed for building an information-security system that meets the regulator’s requirements.