Vulnerabilities of security systems of the Ministry of Defense, FSB, FSIN, NPP, metro and federal highways

• high , if as a result of violation of one of the security properties of information (confidentiality, integrity, availability), significant negative consequences in social, political, international, economic, financial or other areas of activity and / or information system and / or operator (information owner) are possible can perform the functions assigned to them;
• moderate if a violation of one of the security properties of information (confidentiality, integrity, availability) may have moderate negative consequences in social, political, international, economic, financial or other areas of activity and / or the information system and / or operator (owner of information) can perform at least one of the functions assigned to them;
• low , if as a result of violation of one of the security properties of information (confidentiality, integrity, accessibility), slight negative consequences in social, political, international, economic, financial or other areas of activity are possible and / or the information system and / or operator (information owner) can perform the functions assigned to them with insufficient efficiency or the performance of functions is possible only with the involvement of additional forces and means.

• The highest level of control, the first , is sufficient for software used in the protection of information marked “OB”.
• The second level of control is sufficient for software used in the protection of information marked “CC”.
• The third level of control is sufficient for software used in the protection of information marked "C".
• The lowest level of control - the fourth , is sufficient for software used in the protection of confidential information

“And these people forbid me to poke around in my nose?”

• In 9 out of 10 systems, any external intruder acting on the part of the Internet is able to gain access to the internal network nodes. Moreover, in 55% of cases, an external attacker could develop an attack and gain complete control over the entire infrastructure of the company.
• On average, an external attacker needs to exploit two different vulnerabilities to overcome the network perimeter, and in order to carry out an attack in 82% of cases, it is enough to have an average or low qualification.
• In 40% of cases, the intrusion vector in the internal network is based on weak password protection. Just as in the previous two years, this vulnerability is the most widespread, it was found on the network perimeter of 82% of the systems studied, and in each of these systems the vocabulary passwords were also present in web applications. In 67% of companies, vocabulary passwords were used for privileged accounts.
• In every third system, access to the internal network is carried out through web application vulnerabilities. Thus, vulnerabilities like "Download arbitrary files" and "Implementation of SQL statements" are found in 55% of systems. In general, web application vulnerabilities were found in 93% of the systems studied. The overall level of security in this area remains extremely low, as was the case in the previous two years.
• Compared to 2011–2012. The average level of network perimeter security has gone down. The share of systems increased by 17%, where it was possible to gain access to the internal network (from 74% to 91%). To conduct attacks to an outside attacker, lower qualifications are now required, overcoming the perimeter on average requires the exploitation of fewer vulnerabilities (2 vs. 3 in the previous two years). The current picture indicates that the protective measures used are developing more slowly than modern methods of attack and cannot provide a sufficiently high level of security. For example, the share of systems where actual security updates are not installed on the network perimeter nodes has significantly increased (from 10 to 64%).

• In all the systems studied, an unprivileged internal intruder located in the user segment of the network may somehow extend its privileges and gain unauthorized access to critical resources. At the same time, in 71% of cases, an internal violator can gain complete control over the entire information infrastructure of the organization.
• Only in 17% of cases, the internal attacker must be highly qualified to gain access to critical resources, whereas in half of all systems studied, successful attacks are possible from any unqualified user of the internal network. On average, if you have access to the internal network, an attacker needs to exploit 5 different vulnerabilities to control critical resources.
• The most common vulnerability of internal network resources is still the use of weak passwords, which are found in 92% of systems. The next most common ones are weaknesses in filtering and protecting service protocols (ARP, STP, CDP, etc.), leading to the interception and redirection of traffic, and storing important data in the open form. These vulnerabilities are found in 67% of systems.
• The level of security of internal networks has decreased compared to 2011–2012. Obtaining complete control over important resources from the internal network has now been possible for 100% of the systems reviewed, whereas previously a similar result was obtained in 84% of cases. As for attacks from an external attacker, the average number of vulnerabilities that are necessary for a successful attack decreased from 7 to 5. The required skill of the attacker also decreased: for 50% of attacks with a sufficiently low qualification, whereas previously this qualification was sufficient for 40 % attacks. In general, despite some improvements in certain areas (increased, for example, the level of anti-virus protection), the measures applied are not enough to counter modern attacks.

• In 66% of cases, as a result of assessing the awareness of users in matters of information security, one or other shortcomings were found. In every third system, the level of user awareness was assessed as low; in these systems, over 20% of the phishing mailing recipients followed the suggested links and launched the proposed file or entered their credentials.
• On average, every tenth user navigated through the proposed link, while 3% of users attempted to enter into dialogue, and 4% of the subjects downloaded executable files or entered their credentials in the proposed authentication form.
• Staff awareness in information security issues has increased. In 2013, in every third system, the level of awareness was rated as acceptable.

• Objects of critical infrastructure are the objects of attacks. Representatives of 1 of 13 objects of the critical infrastructure of the Russian Federation suspect that they have become victims of cyber attacks committed with a specific purpose, and at every hundredth enterprise they are absolutely sure of this.
• Russian enterprises rely more on their own strength than on state programs to protect critical infrastructure facilities. The attitude of enterprises to these programs is rather skeptical (this was stated by 35% of respondents). Nevertheless, Russian critical infrastructure facilities, although to a lesser extent than the world average, are willing to cooperate with the state (most companies expressed a neutral or positive attitude about this)
• Potential to improve the readiness of enterprises. Research data shows:
• 20% of objects of critical infrastructure of the Russian Federation do not react properly to information security incidents;
• 26% of critical infrastructure facilities do not apply sufficient measures to control access to infrastructure based on credentials;
• 30% of critical infrastructure do not have a disaster recovery plan for information systems, or it is in a low state of readiness;
• 30% of critical infrastructure do not apply sufficient measures to ensure the security of websites;
• 33% of critical infrastructure facilities do not properly monitor information security;
• 34% of critical infrastructure does not apply sufficient measures to protect the network;
• Executive management 35% of critical infrastructure facilities are not aware of the importance of information security threats adequately;
• 37% of critical infrastructure objects do not apply sufficient measures to ensure the security of electronic messages;
• At 39% of critical infrastructure facilities, safety training is not conducted at an adequate level;
• 45% of critical infrastructure facilities do not conduct a sufficiently high level security audit;
• (51%) ( , , ..), .
• . : , . , , , . , , .
• . , -7% +25% . — 41%, 70% .