160 CII entities will be connected to the system for combating DDoS attacks based on TSPU

As part of DigitalTech, which takes place in St. Petersburg from November 9 to 10, Tatyana Matveeva, head of the Russian Presidential Administration for the Development of ICT and Communications Infrastructure, said that from the beginning of 2024, a system for countering DDoS attacks based on TSPU (technical countermeasures) threats) 160 organizations will have to connect, while for now the system is operating in test mode.

Roskomnadzor clarified to Kommersant that government organizations, companies in the financial and transport sector, energy, media and telecom operators are joining the system being created to counter DDoS attacks. The list of organizations is determined jointly with the Ministry of Digital Development, FSTEC of Russia and other interested departments. The Ministry of Digital Development forwarded the request to Roskomnadzor.

The Main Radio Frequency Center (GRFC), subordinate to Roskomnadzor, announced the creation of the system itself last fall. “TSPU, among other things, block content prohibited in Russia and fight malicious traffic that is used for DDoS attacks,” explained representatives of GRCHTS. Then they statedthat TSPU has already helped repel DDoS attacks to 65 organizations, including Russian Post, the Ministry of Culture, and Russian Railways.

Work on creating the system began in the summer of this year; in June, Roskomnadzor announced a tender for its development worth 1.4 billion rubles. The work included the refinement of GRChC’s existing software for TSPU, the creation of a coordination center for protection against DDoS attacks, the supply of equipment and the transfer of the right to use the relevant software.

To carry out a DDoS attack, attackers infect hundreds of thousands of devices: from computers and smartphones to IoT gadgets like routers, explains Fedor Dbar, commercial director of Security Code. Then the devices, using a specific command, send requests to the specified resource. To repel such an attack, it is necessary to block anomalous traffic. However, protection will be effective only if all traffic goes through the TSPU, and not some part of it, he points out.

Director for Strategic Alliances and Interaction with Government Authorities of the Garda Group of Companies, Pavel Kuznetsov, believes that first of all, resources belonging to organizations whose downtime can directly affect the standard of living of citizens and the most important industries should be connected to the system.

However, Kommersant’s interlocutor in the information security market reminds that a system based on TSPU only works by tracking patterns of malicious packets in traffic, that is, where it comes from, whether there are atypical IP addresses, etc. If these indicators change, then the system becomes ineffective. The presence of such a system is better than the complete lack of protection against DDoS attacks, but it will not be able to compete with professional solutions, Kommersant’s interlocutor believes.

Tatiana Isakova