In Russia, a system is being created to counter DDoS attacks. 160 state, financial and transport companies will be connected to it

2023

Requirement for connection of 160 state, financial and transport companies to the system

On November 9, 2023, Tatyana Matveeva, head of the Presidential Directorate for the Development of Information and Communication Technologies and Communications Infrastructure, said that 160 subjects of critical information infrastructure (CII) would have to connect to the system for countering DDoS attacks based on TSPU (technical means of countering threats) by the beginning of 2024. These are government agencies, companies in the financial and transport sector, power, media and telecom operators. The list of organizations is determined jointly with the Ministry of Digital Development, FSTEC of Russia and other interested departments.

TSPUs, among other things, block content banned in Russia and fight against malicious traffic that is used for DDoS attacks. Pavel Kuznetsov, director of strategic alliances and interaction with state authorities of the Garda group of companies, said in a conversation with Kommersant that, first of all, resources belonging to organizations should be connected to the system, the simple processes of which can directly affect the standard of living of citizens and the most important industries.

160 subjects of critical information infrastructure will have to connect to the system for countering DDoS attacks

Fyodor Dbar, commercial director of Security Code, says that in order to effectively protect against DDoS attacks, it is necessary that all traffic go through the TSPU, and not some part of it.

According to a newspaper source in the information security market, it reminds that a system based on TSPU works only to track patterns of malicious packets in traffic, that is, where it comes from, whether there are atypical IP addresses, etc. If these indicators change, then the system becomes ineffective. The presence of such a system is better than the complete absence of protection against DDoS attacks, but it will not be able to compete with professional solutions, the source said.^[1]

Test System Startup

On October 25, 2023, Sergey Khutortsev, director of the Public Communications Network Monitoring and Management Center (CMU SSOP) subordinate to Roskomnadzor, announced the start of the national system for countering DDoS attacks. According to him, the test launch of the platform will take place in November 2023, and the full-scale launch in the first quarter of 2024.

As Khutortsev noted, telecom operators will not be forced to connect to the national system of countering the DDoS attack - they will do it voluntarily, it is in their interests. By the end of October 2023, several telecommunications companies and developers of solutions to protect against DDoS attacks expressed a desire to use the platform's capabilities, he said. Khutortsev explained that information will come to the system from technical means of countering threats, as well as from owners of information systems and telecom operators.

Test launch of the platform will take place in November 2023

They give us information about monitoring, and in return they get the opportunity to use TSPU to block attacks on their own pool of IP addresses. That is, they themselves will actually be able to manage locks for their area of ​ ​ responsibility, - explained the head of the CMU SSOP.

For the incomplete first 10 months of 2023, TSMU SSOP recorded and prevented about 9.6 thousand. DDoS attacks, which is 300% more than a year earlier. 180 of them were large and led to the refusal of a significant part of the Russian infrastructure, said Sergey Khutortsev. He also spoke about the work of the SMU SSOP to expand the possibilities of blocking attacks.

We are building two traffic purification centers with a total capacity of almost terabit. They will contain professional equipment and security tools that will allow you to filter complex attacks in which it is already necessary to pass the traffic of the attacked entity through this infrastructure. Here we will help both the industry and the attacked information systems, but first of all this infrastructure will be intended for socially significant information resources and subjects of critical information infrastructure, "he said.[2]

Creating a System

In mid-June 2023, it became known about the creation in Russia of a national system for countering DDoS attacks. The corresponding contract worth 1.43 billion rubles was concluded by the Main Radio Frequency Center (GRCC) subordinate to Roskomnadzor.

According to Kommersant, the contract was concluded on May 25, 2023, but by June 13, 2023, the performer was not named. Among the goals named in the purchase is the creation of a coordination center for protection against DDoS attacks. It is also necessary to modify the developed software of the centralized control system for TSPU equipment (technical means of countering threats). TSPU - equipment placed by Roskomnadzor on operators' communication networks, it allows it to filter traffic and block prohibited sites.

A national system for countering DDoS attacks is being created in Russia

According to Artem Konstantinov, head of the Antimonopoly Law and State Order practice at Lemchik, Krupsky and Partners, we are talking about finalizing the existing TSPU software at GRCC. The GRCC had no choice but to conduct a non-competitive purchase from the person who had previously transferred him a non-exclusive license for software without the right to process, he argues.

This practice is really common, - said the lawyer, adding that the contract itself should have been laid out no later than three days from the date of its signing, he concludes.

Systems to counter DDoS attacks are divided into cloud and backbone, the latter work on the telecom operator's network, explains Forbes interlocutor in the information security market. Apparently, the system that the GRCC proposes to create will be of the trunk type: according to two sources of publication in this market, Rostelecom should be the supplier of the system. Create a system, according to the terms of the contract, it is necessary until March 12, 2024.^[3]

Notes