RSS
Логотип
Баннер в шапке 1
Баннер в шапке 2
2024/10/17 09:54:31

Security Analysis Services (Russian Market)

The main articles are:

2024: The bill on the legalization of the activities of pentesters in the Russian Federation was adopted in the first reading

The bill, which proposes amendments to article 1280 of part four of the Civil Code of the Russian Federation to legalize the activities of information security specialists or pentesters in Russia, passed the first reading in the State Duma. This was announced on October 16, 2024 by the press service of Anton Nemkin, a member of the State Duma Committee on Information Policy, Information Technology and Communications.

The authors of the bill - representatives of the party project "Digital Russia" Anton Nemkin, Gennady Panin, Igor Markov and the State Duma Committee on Information Policy Vyacheslav Petrov and Anton Tkachev - propose to amend article 1280 of part four of the Civil Code of the Russian Federation.

One of the authors of the bill, Anton Nemkin, speaking at a plenary session of the State Duma, recalled that 37% of the Russian companies are subjected to the attacks hackers at least once a month. In the first half of 2024 alone, the number DDoS-attacks of Russian organizations increased to 355 thousand, which is 16% more than in the entire 2023. At the same time, objects are often under attack. critical information infrastructure For example, in September 2024, the number of DDoS attacks on [telecommunications and communications' telecom]] companies increased by 74%.

File:Aquote1.png
Against the background of the increased number of cyber attacks, it is no longer enough for our government agencies and companies to simply have their own IT staff, it is important to systematically audit the security of their systems with the help of independent professionals - the so-called pentesters. Their work should become as necessary and systematic as, for example, an independent external audit of financial statements or third-party legal audits of businesses. This is especially important when it comes to protecting huge amounts of personal data of citizens and access to key state systems and services, the deputy said.
File:Aquote2.png

According to Nemkin, the amendments to Article 1280 of the Civil Code are the first of a package of prepared bills aimed at regulating the work of pentesters, which are in no hurry to get out of the shadows in view of the existing risks of prosecution.

So, in order to test the security of the systems of Russian companies, pentesters need to obtain a large number of permissions from the copyright holder of each program that is part of the information system. Testing without such permits may entail copyright infringement, and they may be obliged to pay compensation in the amount of 10 thousand rubles to 5 million rubles, or in two times the cost of the right to use the corresponding program.

{{quote 'Our draft law provides for the possibility of studying, researching or testing the functioning of programs by a person who rightfully owns a copy of the program for COMPUTER, or by a person acting on his behalf, in order to identify it vulnerabilities to correct obvious errors. In this case, these actions are carried out exclusively in relation to programs operating on the user's technical means. In order to protect the rights and interests of the program's copyright holders, we have provided for a ban on the transfer information of identified defects to third parties. At the same time, we propose to establish the obligation of the person who identified the shortcomings to inform the copyright holder about them within five working days from the date of their detection, "Nemkin explained. }}

As of October 2024, not hundreds, but tens of thousands of hackers are operating in the online space, most of them are supported and funded by the special services of unfriendly countries. Their goal is to steal personal data of citizens at any cost, which will then be used for illegal purposes, as well as through vulnerabilities to disable critical systems. If such attacks are successful, the consequences can be catastrophic and affect millions of citizens if measures are not taken in advance to prevent them.

File:Aquote1.png
Pentesters work to determine the logic of potential criminal hackers, modify vulnerabilities and strengthen the protection of information systems and resources. Therefore, the transformation of legislation in terms of their work is especially relevant, - concluded the parliamentarian.
File:Aquote2.png

2023: Russian Security Analysis Market Trends Analyzed

Angara Security analyzed more than 200 implemented projects and competitive procedures in the field of security analysis for 2022-2023. The main conclusions of the study:

  • About 60% of security analysis projects are implemented within two price segments: from 500 thousand rubles to 1 million rubles (23.7%) and from 1 million to 2 million rubles (37%).
  • Compared to 2022, the share of projects in the marked price segments increased by an average of 65%.
  • Security analysis services are most in demand among financial institutions and insurance companies (about 40% of projects and competitive procedures), telecom and IT companies (28.8%).

Among the most demanded services in the field of security analysis are the following areas:

Budget from 500 thousand to 1 million rubles: services of external and internal pentest, analysis of the security of web and mobile applications. Angara Security analysts associate the growth in the number of projects in this price range with requests to check the level of security of user digital services and applications, as well as with interest from small and medium-sized businesses, IT developers who previously did not pay much attention to information security.

Budget from 1 million to 2 million rubles: most often this category includes services that require automated security analysis and an expert approach to risk assessment and vulnerability management. These include code analysis services, sociotechnical research, testing using social engineering tools, monitoring the security of the external perimeter, critical information systems.

File:Aquote1.png
The growth of projects in this category is more often associated with repeated requests from customers who already have experience in conducting pentests, understand what result they need from this type of testing and increase the requirements for expertise and experience of the team organizing the security assessment, "said Andrey Makarenko, head of business development at Angara Security.
File:Aquote2.png

Analysts also note the demand for solutions for monitoring the effectiveness of information protection tools on the external perimeter, therefore, the market also requires comprehensive simulation of cyber attacks (red team) with verification of the reaction of employees of internal SOC centers and information security units in branches of large companies.

File:Aquote1.png
There is also a growing demand for security analysis in white box mode. Such pentests identify almost all application vulnerabilities and are most effective. At the same time, there are high requirements for professionalism, training and certification of the team of performers, − was supplemented by Mikhail Sukhov, head of the security analysis department at Angara Security.
File:Aquote2.png

Among the promising areas in the field of security analysis, Angara Security analysts also note the automation of checks that can be carried out without the involvement of experts, as well as the integration of OSINT and analysis tools into comprehensive penetration test services, phishing attacks control of the external perimeter attack surface, comparison of techniques industries and attacks.