Jet Infosystems has developed an information security strategy for the Delo transport and logistics holding

2024: Conducting an audit of the information security structure

Jet Infosystems conducted an audit of the information security structure at 18 sites of the Delo Group of Companies and developed a strategy for the development of information security with a roadmap for changes. As of August 2024, Delo Group of Companies has already implemented part of the strategy and is developing an information security management system, approaching the target state and minimizing risks for business and customers. This was reported to Jet Infosystems on August 28, 2024.

Delo Group of Companies - Russian transport-logistic holding. In Russia 2022, DeloTech LLC (part of Delo Group of Companies) was established to consolidate the Group's IT assets. After that, Delo Group of Companies began to actively introduce digital solutions that need protection. Part of the digitalization process of the holding was the creation and implementation of a new strategy information security company developed for the Group by the IT company Jet Infosystems.

At the first stage of the project, the specialists of Jet Infosystems conducted an audit of the current organizational structure and technical stack of security systems of 18 sites of Delo Group of Companies. As part of the information security audit, the security of the external perimeter of the company's IT environment was tested, as well as an assessment of the information security tools used, information security processes, the security of the IT infrastructure and business systems and their compliance with regulatory requirements was made. According to the results of the audit, the experts of the Jet Infosystems came to the conclusion that the information security system of the surveyed sites requires changes, in particular, the replacement of equipment, information security tools, the hiring of specialized information security specialists and, in general, increasing the maturity of information security processes.

At the second stage of the project, Jet Infosystems developed a three-year information security development strategy, including a roadmap for initiatives that covers all major areas of information security: management, personnel, processes and applied technologies, as well as the creation of an operational security center (SOC) and a cyber polygon for personnel exercises.

Over the past two years, we have carried out many transformational processes in the field of digitalization and needed a complete re-assembly of information security processes, "said Andrei Redko, CISO of the Delo Group of Companies. - As a result of the project to audit and create a strategy with Jet Infosystems, we have a clear idea of ​ ​ the technical stack, scope of work and human resources that are required to create a modern, strong information security system that can protect us and our clients from threats.

The list of initiatives included in the information security development strategy was formed taking into account the maintenance of the main business goals of Delo Group, reducing information security risks and achieving the target level of the holding's information security structure. Proposals for the development of information security were formed, among other things, taking into account the adapted Cyber ​ ​ Defense Matrix framework, the Cyber ​ ​ Kill Chain tool and the knowledge base on various types of threats Mitre ATT&CK.

The attention of cybercriminals to large Russian companies is greater than ever before. In such conditions, security is needed not for show, but a really effective and adapted information security system for business and IT infrastructure, - said Andrey Yankin, director of the information security center "Jet Infosystems." - For six months, we managed to study in detail all the existing processes and information security tools in Delo Group and develop an information security strategy with which the Group will be able to correctly prioritize and achieve a high level of business protection against cyber risks.