Information security

T1 Integration provides information security audit services taking into account the needs and specifics of the customer's business. The objectives of the audit may be:

• Assessment of the current level of security of critical assets, development of recommendations and an information security risk management plan
• Bringing the information security of the organization into compliance with the requirements of the legislation of the Russian Federation, international standards, requirements of shareholders and counterparties (contractual/contractual obligations)
• Independent outsourcing audit (third party audit) to assess the adoption of due care and due diligence of the organization providing critical services
• The choice of priority areas (the concept of information security and the strategy of information security), the formation of a portfolio of information security projects, the formation of business cases and assistance in defense at the budget committee of the organization
• Improvement of the information security management system and individual processes and procedures

As part of the information security audit, the analysis of organizational and administrative documentation in the field of information security is carried out; assessment of the level of security of critical information and information systems directly at the customer's facilities; testing of individual nodes and information resources for vulnerabilities, including through selective instrumental verification and test samples; identification, analysis and high-level assessment of the main information security risks using a scenario approach; preparation of recommendations for the implementation of organizational, administrative, technical measures and an action plan based on the audit and risk assessment of the organization.

At the request of the customer, the audit planning can be carried out with the help of an audit risk assessment according to the expert methodology of the company "T1 Integration". During the audit risk assessment, the risks of the audit area, the risks of implementing security measures and the risks of detecting vulnerabilities during the audit will be assessed.

Consulting services in the field of international information security standards are relevant for organizations that own a large number of business-critical information resources and consider information security as a comprehensive business-oriented process aimed at reducing operational and management risks.

The approach to integrated information security by implementing an information security management system (ISMS) and related information security processes, implemented by experts "T1 Integration", complies with generally recognized international standards in the field of information security.

Compliance of the information security management system with international standards makes it possible to guarantee the correctness of the construction of this system and the effectiveness of its work.

When building the information security risk management process, T1 Integration follows the ISO/IEC 27005:2011 standard, which contains detailed recommendations on risk management. In the course of the initial high-level risk assessment, the company develops an adapted optimal methodology for risk assessment of information security in accordance with the specifics of the customer's activities and business processes, the category of information security risks, best practices in the field of information security, expert experience.

A high-level analysis of existing information security risks allows the customer to identify critical systems, business units, processes and services for which information security risks are higher than the established threshold.

The customer can use the developed and tested high-level risk assessment methodology in the future, not only in the area where it was used by T1 Integration experts, but also for other sites, projects, information systems or business in general.

Based on the results of the risk assessment conducted by our specialists, recommendations are being developed for the application of an interconnected set of organizational and technical measures aimed at reducing the level of information security risks with the proposal of an economically sound portfolio of information security projects. Complementing the risk management plan, the recommendations are specific in nature and are aimed at the fullest and most effective overlap of all security requirements with a reasonable minimum of costs, including reducing critical risks of information security by implementing policies, procedures and technical means.

The security control system is designed to monitor the level of protection of information systems, timely detection of vulnerabilities and configuration errors of IT infrastructure components. The comprehensive solution offered by T1 Integration allows you to solve the following tasks:

• Ensuring proactive protection of information systems by automatically monitoring the state of the security level
• Ensuring compliance with technical standards and internal corporate requirements
• Automation of the process of inventory and control of changes in information resources
• Reduction of audit and security control costs

An instrumental assessment of the security level allows you to assess the current level of security, identify existing technical vulnerabilities and configuration errors of information systems, as well as justify investments in the development of information security tools. Based on the results of the work, the customer is provided with a report describing the main identified vulnerabilities and recommendations for their elimination.

«T1 Integration» has licenses and accreditation to perform work on certification of informatization facilities according to information security requirements. As a result of the implementation of a set of organizational and technical measures (certification tests), the compliance of the information security system with the requirements that were stated during its creation is documented. Mandatory certification is subject to state information systems, as well as information systems that process information constituting a state secret, or restricted access data owned by state agencies. The commissioning of such information systems is possible only if there is a certificate of conformity.

«T1 Integration» performs the following works:

• Mandatory certification of informatization objects intended for processing information containing information constituting a state secret
• Certification of informatization objects intended for processing confidential information

As part of the certification of informatization facilities, T1 Integration provides the following services:

• Assessment of compliance of the informatization object with information security requirements
• Development of proposals and recommendations for bringing the informatization object into compliance with information security requirements
• Preparation of the informatization object for certification tests, including the creation or improvement of the existing information security system
• Conducting certification tests of informatization objects for compliance with the requirements of regulatory documents in the field of information security

T1 Integration designs and creates integrated information security systems based on the results of information security risk analysis, threat modeling, compliance with regulatory requirements of regulators in the field of information security (FSTEC of Russia, FSB of Russia, Bank of Russia, etc.), as well as individual customer requirements.

Analytical studies show that the best and most effective protection of web applications from threats and vulnerabilities is provided through the implementation of solutions of the Web Application Firewall (WAF) class. WAF solutions are able to prevent attacks that classic firewalls and intrusion detection systems cannot protect against, while they do not require modification of the application source code.

T1 Integration provides services for the implementation of a web application protection solution that provides:

• A fairly high level of security even with default settings
• The ability to configure WAF to protect against specific types of attacks or vulnerabilities (for example, urgently close the vulnerability in the absence of a patch)
• Effective protection against Brute Force login, Parameter tampering, Session hijacking, Cookie poisoning, Cookie injection, Illegal HTTP encoding (double encoding, malicious encoding), SOAP and XML attacks
• Comparative analysis of web application structure elements (form fields, cookies, parameters, etc.) with reference elements stored in profiles
• Profiling HTTP, HTTPS and XML traffic

Remote access technologies, high-speed mobile data networks, cloud technologies shift the value of defining the perimeter from the physical (which previously could be considered the office boundary) to the virtual, where the organization's data is distributed between the existing infrastructure, employee devices and third-party services. This does not negate the need to protect the perimeter, but significantly complicates its organization.

T1 Integration offers comprehensive solutions for the protection of the network perimeter, including security gateways, firewalls and intrusion detection systems. At the same time, each component can also be presented as a separate solution. 

Regardless of the set of protection components, the main task of the system remains the control and management of traffic passing through the equipment. Decisions on allowing or prohibiting a particular traffic can be made based on simple rules, or they can be the result of a set of subsystems that analyze factors such as source, destination, time, data type, abnormal activity, belonging to spam or botnets, and many other factors.

Remote access is a technology that allows you to access information resources and work with them from other networks. It allows you to reduce the costs of organizing the workflow, and also helps to increase the efficiency of using information resources to solve business problems.

To ensure a high level of corporate data security, T1 Integration implements the protection of remote access technology by various methods:

• Creation of virtual secure networks (remote access VPN) with separate applications (clients, including those built into operating systems), working on protocols (for example, IPsec, SSL/TLS, PPP) and using web technologies (SSL/TLS)
• Application of terminal emulation programs using security protocols (for example, SSH)
• Application of remote desktop applications using cryptographic algorithms as part of standardized (for example, RDP, VNC, X.11) and proprietary protocols of manufacturers

The scope of cryptographically secure communication channels covers all areas of information technology application and includes:

• Secure data transfer in data centers, geographically distributed organizations, electronic document management systems, etc.
• Protection of voice communications, videoconferencing and e-mail, which is especially important for call centers, corporate IP telephony systems, geographically distributed videoconferencing complexes, etc.
• Protection of control and monitoring channels

In telecommunication networks, cryptographic protection of communication channels is organized at various levels of OSI: channel (for example, MACsec), network (for example, IPsec), transport and session (for example, SRTP, TSL/SSL), views and applications (for example, S/MIME, PPTP). A wide range of symmetric cryptographic algorithms and public-key cryptosystems, as well as their combinations, are used to organize secure communication channels.

Adaptive technology of virtual secure networks (VPN) has been widely used, which allows you to create a single secure network infrastructure on geographically distributed networks of various topologies. Solutions are based on both network equipment and dedicated devices.

T1 Integration provides services for the organization of cryptographic protection of communication channels in order to ensure confidentiality, integrity and authenticity of transmitted data, authentication of nodes and channels formed between them. The company has all the necessary licenses to carry out activities related to the use of cryptographic tools.

Database protection systems are designed to prevent unauthorized access to information processed in the DBMS, as well as control and filter various types of interactions between the DBMS, users and applications that perform such access. T1 Integration implements projects for the implementation of systems that minimize the risks and possible financial and image losses of the customer associated with the theft of database information.  

Database protection systems allow you to solve the following tasks:

• Implementation of mechanisms for monitoring and accounting for the actions of users and administrators, auditing protected databases
• Implementation of audit mechanisms and prevention of unauthorized access to the contents of protected databases through various scanning mechanisms
• Implementation of tools for detecting and responding to attempts of unauthorized access to information of protected databases
• Operational monitoring of the security status of databases
• Bringing the state of protection of the customer's infrastructure into compliance with the requirements of regulators
• Improving labor productivity and efficiency of the company's divisions responsible for ensuring information security through audit and reporting mechanisms implemented in the system

The introduction of a content filtering system for mail and web traffic allows you to protect corporate mail from unwanted messages, block malware and neutralize viruses in downloaded content, and also contributes to improving the efficiency of staff by controlling employee access to the Internet.

The system solves the following tasks:

• Ensuring that employees have access only to those web resources that may be required as part of their job responsibilities
• Implementation of a centralized policy of access to web resources and protection against threats from public networks
• Minimizing the risk of damage to information systems by malware
• Minimizing the risk of leakage of confidential information
• Reporting incidents and user activity

The company has accumulated considerable experience in implementing content filtering systems for customers from various industries, including companies with large geographically distributed data transmission networks.

DoS/DDoS attack protection systems are mechanisms implemented by various means to detect and neutralize denial-of-service attacks aimed at protected information resources. Taking into account the needs and specifics of the customers' business, T1 Integration implements two approaches to protect against DDoS attacks or combines them:

• Installation as part of the customer's network infrastructure of specialized software and hardware complexes responsible for detecting and responding to DDoS attacks. This equipment filters traffic from illegitimate activity while maintaining legitimate traffic, which ensures the availability of protected resources. As a rule, the use of this approach also implies the installation of filtering equipment also on the part of the communication service provider to ensure guaranteed availability of the bandwidth of the communication channel between the provider and the protected network of the customer company
• Providing the customer with a specialized service for filtering network traffic for the detection of DDoS attacks. With this approach, the customer's network traffic is redirected to specialized traffic cleaning centers

T1 Integration offers services for the implementation of anti-virus protection systems to ensure the security of information resources: workstations, file servers, mail gateways, proxy servers, mobile devices, virtual environments. A comprehensive anti-virus protection system allows you to detect and neutralize various types of viruses and malware in real time, thus ensuring the security and availability of corporate information systems.

Protection of state information systems (GIS) is carried out within the framework of compliance with the requirements of the current regulatory legal acts of the Russian Federation in the field of information security and is aimed at preventing violations of confidentiality, integrity and accessibility of state information resources.

The competencies of the company "T1 Integration" allow not only to build an information security system from scratch when creating GIS, but also to bring the information system already put into operation into compliance with the current legislation.

T1 Integration performs a full range of work from the formation of requirements for the protection of information contained in GIS, the development and implementation of a GIS information protection system to the certification of GIS according to information protection requirements. The project can also analyze information system vulnerabilities and take information protection measures to eliminate them. If personal data of subjects is processed in GIS, the information protection system is built taking into account the requirements of legislation in the field of personal data protection.

Having a license to carry out work on the technical protection of confidential information, T1 Integration offers a comprehensive solution for the examination of the processes of automated and non-automated processing of personal data and the creation of a comprehensive system for the protection of personal data during their processing in information systems and guarantees the protection of personal data in full compliance with the requirements of Federal Law No. 152-FZ of July 27, 2006 and by-laws and regulations.

Personal data protection is carried out by our experts in stages and includes:

• Formation of requirements for the protection of personal data contained in personal data information systems, including classification of the information system according to information protection requirements, identification of current threats to the security of personal data
• Development of a comprehensive system for personal data protection, including the design of a security system, development of operational documentation, development of projects of organizational and administrative documents
• Commissioning and warranty support of a comprehensive personal data protection system

The result of the work on the protection of the customer's personal data is an optimal set of organizational and technical measures in terms of cost, quality and reduction of business risks, taking into account the specifics of the organization and the risks of business activity in the event of threats to the security of personal data, as well as image losses and violations of legislation, including regulatory inspections.

The approach to ensuring the security of critical objects with the priority of ensuring the availability and integrity of not only information, but also other tangible and intangible assets is non-standard from the point of view of information security. Therefore, T1 Integration considers threats and security measures not only from the point of view of information security, but also cybersecurity, as well as the continuity of information and communication systems.

From the point of view of managing the best practices of information security and cybersecurity, T1 Integration offers to use a set of domestic and international standards in the field of information security management, network security, industrial security, etc.

The process of developing a concept, strategy, planning and building an information security management system and countering cyber threats is inextricably linked to the process of risk management not only of information security, but also of technological risks, and therefore risk management is a key section of each standard and manual on the security of automated control systems and critical systems. As a basic standard, it is proposed to use the accumulated international experience in the form of ISO/IEC 27005 — Information security risk management; ISO 31000:2009 — Principles and Guidelines on Implementation; ISO/IEC 31010:2009 — Risk Management — Risk Assessment Techniques; ISO Guide 73:2009 — Risk Management — Vocabulary.

T1 Integration offers a comprehensive solution that combines advanced network technologies into a single system for managing user access to corporate network resources. This makes it possible to ensure the protection of business-critical information, minimize the risks of unauthorized use of information systems and the possibility of intentional violation of the integrity and availability of data.

The basis of the user access control system to network resources is a flexible policy that allows you to make decisions about assigning an access level to a connected user or device, depending on a number of factors. The system monitors the inconsistencies of the user's workstation with the security profile in real time and blocks access for potentially dangerous devices.

«T1 Integration» has experience in successful implementations of this technology. One of the largest projects was the creation of a system in the central office and 8 branches of a large energy company.

T1 Integration offers a comprehensive solution aimed at preventing unauthorized actions of users with extended access rights to information systems: administrators, operators, developers, engineers of third-party IT services during outsourcing, etc. The privileged user management system is designed to provide preventive protection and minimize potential damage from abuse of authority by monitoring privileged accounts.

The implementation of a privileged user management system allows you to:

• Provide control over the actions of privileged users using standard management protocols (RDP, SSH, X11, Telnet, HTTP(S), VNC, etc.)
• Record administrative management sessions in video with the possibility of further content search
• Implement centralized access control, including for group accounts
• Implement authorization using the "4 eyes" method
• Provide centralized management and storage of authentication data (including passwords)
• Minimize the threat of external attacks conducted with privilege escalation
• Ensure compliance with the requirements of IS standards (for example, PCI DSS, STO BR IBBS, etc.)
• Prevent the possibility of hiding traces of unauthorized or unprofessional actions
• Optimize administration processes, increase labor productivity and responsibility of IT personnel

Multi-factor authentication systems are designed to enhance the level of protection against unauthorized access of corporate information systems. Unlike one-factor authentication (for example, using only a password), at least two authentication factors are used in such systems.

Multi-factor authentication is used in remote access subsystems, virtual private networks, Internet banking, information systems and web portals. Hardware identifiers can also be used for electronic signature functions or to control physical access to premises when they are integrated with an access control and management system (ACS).

The introduction of multi-factor authentication systems allows you to:

• Ensure compliance with the requirements of international and domestic standards in the field of information security
• Ensure compliance with the requirements of the legislation of the Russian Federation in the field of personal data protection and state information systems
• Reduce the risks associated with obtaining unauthorized access to protected information systems

When creating multi-factor authentication systems, T1 Integration uses products from Russian and foreign manufacturers, in the portfolio of which there are both various authentication tools (USB tokens, smart cards, one-time password generators, hybrid authenticators) and means of centralized management of their lifecycle. Most multi-factor authentication solutions support authentication using SMS, software tokens, mobile applications and mobile phones used as a hardware authenticator. In addition, biometric data of users (fingerprints, retina, etc.) can be used for authentication purposes.

The system of centralized monitoring and management of information security events (SIEM) allows for effective centralized collection, visualization and correlation of information security events from various information systems and information security tools. Such systems are designed to automatically identify threats to information security and ensure prompt response to information security incidents.

T1 Integration implements systems that solve a set of tasks for monitoring and managing information security events in order to reach a new level of security of information systems, including:

• Organization of centralized collection, analysis and prioritization of messages from various sources (intrusion detection systems, firewalls, operating systems, access control and management systems, antivirus systems, web filtering systems, data leakage control systems, various applications, databases, etc.)
• Detection of anomalies in the operation of systems and prevention of internal fraud
• Visualization of the received data in real time and notification of information security incidents
• Ensuring compliance with the requirements of IS standards (PCI DSS, STO BR IBBS, etc.)
• Improving the efficiency and effectiveness of the investigation of information security incidents.

T1 Integration has all the necessary licenses, competencies and experience to carry out information protection work and assess compliance with the requirements of the Regulation of the Bank of Russia No. 382-P regulating the security of payment information for participants of the national payment system. The company offers the following services:

• Conducting assessments of compliance with the requirements of the BR Regulation No. 382-P
• Design and implementation of technical solutions, construction of information security assurance and management processes to ensure compliance of participants of the national payment system with the requirements of the BR Regulation No. 382-P

STO BR IBBS (the standard of the Bank of Russia for ensuring information security of organizations of the banking system of the Russian Federation) is a set of documents of the Bank of Russia, which describes an approach to building an information security system in banking organizations, taking into account the best international and domestic practices.

Banking organizations that have decided to introduce the IBBS BR complex are required to conduct a regular assessment of compliance with the requirements of the standard at least once every two years and submit relevant reports to the Bank of Russia.

With the relevant competencies and experience, T1 Integration provides the following services:

• Conducting assessments of compliance with the requirements of STO BR IBBS 1.0
• Designing and implementing the necessary technical solutions, building information security assurance and management processes in order to bring banking organizations into compliance with the requirements of the BR IBBS complex