How EVRAZ Built Effective Information Security Processes Without Draconian Restrictions

EVRAZ operates one of the smallest information security teams in its industry yet achieves strong results, including more than 92 percent compliance in the latest external audit and high maturity scores against sector benchmarks.

Andrey Nuykin, head of the Information Security Department, oversees protection for over one thousand developers, tens of thousands of users, industrial systems, and numerous IT contractors. The team deliberately avoids heavy-handed prohibitions, preferring negotiated requirements and extended rollout periods instead of sudden restrictions.

Gradual rollout of security controls

Security involvement begins at the project request stage and continues through technical specification, architecture design, development, and production handover. An internal instruction detailing requirements for all information systems is available to project managers and IT staff. Every project receives an assigned leader from EvrazTekhnika, the company’s in-house IT provider.

Architecture diagrams must be submitted for review. Internet-facing services require intermediate servers in a DMZ with explicitly defined data flows. Once architecture is approved, static code analysis is embedded in the DevOps pipeline. Failed scans block the pipeline until vulnerabilities are fixed or marked as false positives under controlled conditions.

From development to production

Before moving to pilot operation, the security team verifies that agreed controls remain in place. A system passport is then prepared, documenting ownership, criticality, accounts, roles, certificates, and data categories. All operational units must sign off before the system enters full production.

After deployment, the monitoring center receives events, performs correlation, and issues tickets for vulnerability remediation and incident response.

Handling developer resistance and AI-generated tools

Developers once resisted implementing WAF and DDoS protection on a public service, claiming performance impact. After the team temporarily disabled the WAF during a platform migration, the same developers requested its return within three weeks due to a surge in unwanted bot traffic.

A separate incident involved a business-unit employee who built an AI-assisted internal dashboard that grew popular among managers. A quick pre-meeting assessment by the security team revealed multiple exploitable flaws. The employee was persuaded not to expose the service externally and was directed to rebuild it under proper IT governance.

The department now works to extend established review processes to cover widespread use of generative AI tools by non-developers, focusing on data leakage risks and uncontrolled code rather than blanket prohibitions.