Center for Strategic Assessment and forecasts

Autonomous non-profit organization

Home / Defence and security / / Articles
Cyberpassage: Sberbank proposed to establish the headquarters of the struggle with hackers
Material posted: Publication date: 04-09-2017
Sberbank proposed to create a national cybersecurity center — "curator" of the existing institutions in the field of information security. The need to create a Bank account low efficiency of the fight against cybercrime.

Sberbank proposes to create in Russia the national cybersecurity center (NCC) is the main authority on information security in the country. This is stated in the presentation of the Deputy Chairman of Sberbank, Stanislav Kuznetsov (have RBC). Top managers of three companies working in the field of information security, RBC confirmed the authenticity of the document. According to interlocutors RBC, the document Kuznetsov presented on Monday, August 28, at the kick-off meeting of the competence Center in the field of "Information security" (created for the implementation of the state program "Digital economy").

Alina Shlyapnikova, the representative of the company "Kaspersky Lab", where staff attended a meeting with Kuznetsov, told RBC that the meeting really raised the question of establishing a national cybersecurity center. "But it was the installation meeting and details it was not discussed", — she added.

In a press-service of the savings Bank at the time of publication of the material did not respond to a request RBC.

When in Russia there will be "Digital economy"

The state programme "Digital economy" was signed by Prime Minister Dmitry Medvedev on July 31. The programme identifies five basic directions of development of digital economy in the country for the period up to 2024, among which are regulation, talent and education, the formation of research competences and technical capacities, information infrastructure and information security. For each of these areas is assigned to a responsible Federal Executive authorities and organization, creating a center of expertise that are directly engaged in the implementation of the provisions of the instrument.

Under the direction of "Information security" program included a centralized system of monitoring and management of communication networks, the decline in cross-border traffic in the Internet, legislating the control of the use of big data and other initiatives. The Ministry of communications appointed a responsible authority in this area, and Sberbank — center of competence, the head of which is selected Stanislav Kuznetsov.

NCC should be the key structure for the protection of the country in the information space, to be presented in the presentation of Sberbank of architecture of national cyber security system. It will receive information from the international centers of security, foreign centers incident response in the field of information security (computer emergency response team, CERT), law enforcement agencies and regulators.

According to the proposal of the Bank, NCC will be the curator of all existing institutions in the field of information security. Under his control, in particular, needs to go RU-CERT (created by the Russian scientific research Institute of development of public networks), GOV-CERT (created FSB), the State system of detection, prevention and elimination of consequences of computer attacks (Gossipy, c 2013, created the FSB on behalf of the President) and industry CERT — for example, existing at the Central Bank in 2015 FinCERT (created to share information about attacks on financial institutions). According to the Bank's scheme, the same CERT is supposed to create and to share information among enterprises of energy and telecommunications, to then transmit data in NCC.

The establishment of a new regulator at the Bank explain the low effectiveness of mechanisms to combat cyber crime. In the presentation Kuznetsova the data from the analytical review of the investigative Department of the Ministry of interior for 2016: 75% of all criminal cases in the field of cybercrime has been suspended from-for impossibility to establish the identity of the offender. Before the trial came only 7% of such cases. The document also notes that the Russian law enforcement agencies are lagging behind in responding to cyber attacks, and Telecom operators are not required to protect against cyber attacks. As a result, "organizations really have nowhere to go in case of a cyber attack," reads the presentation. The interior Ministry at the time of publication had not responded to a request to RBC.

In January 2017 the Center for information protection and special communications Nikolay Murashov said that only the objects of critical information infrastructure (CII) in Russia, which include information systems of government agencies, defense industry, transport, credit and financial services, energy, fuel and nuclear industries, in 2016, were attacked about 70 million times. To protect them on July 26, Russian President Vladimir Putin signed a package of laws On "safety CUES". By January 1, 2018, when the law comes into force, the owners must implement a set of measures to protect its infrastructure from hackers, in particular to connect to Goscopy.

"The President in 2013 issued a decree that defines the structure of Gossipy, and presented by the savings Bank architecture national cyber security system won't respond fully. Apparently, this is someone's proposal to create a fundamentally new structure of the national cyber security system", — said the Director for marketing of Solar Security Valentin Krokhin, at the request of RBC familiar with the presentation of Sberbank.

Two of the interlocutor on the market of information security saying that Sberbank plans may be the establishment of the NCC on the basis of its subsidiary company "Safe information area" ("bison"). This company was created in 2016 and, according to information on its official website, deals with security analysis infrastructure of the Bank from cyber attacks and the investigation of incidents in this area. However, the interlocutor of RBC, close to Sberbank, says that he about these plans is unknown: "Such a structure should be established on the basis of authority, such as FSB or the interior Ministry. The establishment of the NCC on the basis of a private company is simply impossible," he says.

"The idea of centralized management of cybersecurity rises not for the first time, but before this suggestion was mainly for a single regulator responsible for various aspects of cybersecurity. Beyond ideas, it never went, due to the presence of different interests and objectives from existing structures — FSB, FSTEC, the Bank of Russia, Ministry of communications, Roskomnadzor and other things," said independent information security expert Alexei Lukatsky. He notes that the creation of a single center on the basis of the Bank that does not have sufficient competence in the industry, Telecom, energy, healthcare and other sectors of the economy, is "utopia". "In any large state there is no such Central structure, which would be reported or submitted to all the other response centers and monitoring. This scheme is only possible at the level of individual industry that is used worldwide," says Lukatsky.

So, NTSK exist in several countries. For example, in the U.S. it was established in 2008 as a division of the Ministry of internal security of the United States, but is only concerned with the protection of communication networks of the government. In Germany, a similar structure appeared in 2011 and is subordinated to the Federal office for information security. In the UK, the NCC was established in 2016 and is a division of GCHQ.

Digital candidate

In addition to the competence centres in the areas of "Digital economy", to monitor its implementation will create the Autonomous non-profit organization. Its founders are Sberbank, Rostelecom, Russian technologies, Rosatom, SKOLKOVO Foundation, "Yandex", Mail.Ru Group, Yandex, MegaFon and other large organizations. This was previously stated by Prime Minister Dmitry Medvedev.

The interlocutor of RBC, close to one of the founders, says that as the head of ANO "Digital economy", there are two candidates — the Deputy Director of the direction "Young professionals" Agency for strategic initiatives Evgeny Kovnir and Vice-President of the Center for strategic research Vladimir Knyaginin. This was confirmed by RBC representative of "Yandex" Asya Melkumova. "As far as we know, discussed the two candidates — Evgeny Kovnir and Vladimir Knyaginin. Soon they will present all of the co-founders of their plans and their vision for the development of the project. The decision will be made on the basis of these reports," Melkumova said. Vladimir Knyaginin declined to comment, Evgeny Kovnir has not responded to a request to RBC.

Mary Kolomichenko


RELATED MATERIALS: Defence and security