FSTEC Publishes 35-Point Network Perimeter Recommendations, Most Require No Spending
Russia's Federal Service for Technical and Export Control (FSTEC) published a set of non-mandatory recommendations titled "Recommendations on Protecting the Network Perimeter of Information (Automated) Systems" on 10 March 2026. The document analyzes successful external intrusions and provides a 35-point checklist for hardening network boundaries.
The guidance appears in the section for improving information infrastructure security and does not carry the legal weight of normative acts or the methodological documents made compulsory by paragraph 68 of Order No. 117. No deadlines or penalties are attached, yet the text is expected to influence post-incident reviews because it reflects attack paths regulators have observed in real cases.
The checklist is organized into eight sections: administration of perimeter devices (10 points), DDoS resilience (5 points), segmentation (5 points), configuration backup (6 points), vulnerability management (2 points), authentication and access (3 points), event logging (3 points), and incident response exercises (1 point). Four items require new purchases—WAF in attack-prevention mode, ZTNA, NAC, and SIEM—while five others depend on capabilities already present in the environment.
Twenty-six remaining points can be satisfied without additional spending. These include using separate air-gapped administrative workstations where possible, enforcing 15-character passwords with complexity rules on network devices when certificate authentication is unavailable, maintaining unique credentials per device, disabling HTTP and SNMP v1/v2 in favor of HTTPS and SNMP v3, documenting all perimeter assets, and performing quarterly restoration tests of configuration backups.
The document explicitly prohibits publishing management interfaces (SSH, RDP, VNC) on the perimeter or in the DMZ, administering core devices from user or external segments, and relying on legacy monitoring protocols. It also stresses compensating controls for end-of-support equipment that cannot be patched or decommissioned.
Sections on vulnerability management refer readers to four earlier FSTEC documents: the 25 November 2025 Protectedness Analysis Methodology, the 17 May 2023 Vulnerability Management Guide, the 28 October 2022 Update Testing Methodology, and the 30 June 2025 Criticality Assessment Methodology.
Related articles
Separating Identity and Delivery Channels for Compliant Telegram Mini App Authentication
A developer shared a detailed case study on building legally compliant user identification for Telegram Mini Apps targeting Russian audiences. Instead of relying solely on Telegram initData verification, the project routes authentication through established Russian providers including VK ID, Yandex ID and MAX. Identity is handled separately from message delivery channels, with telegram_id used only for notifications after account creation. The implementation employs OAuth 2.1 with PKCE for VK, OAuth 2.0 for Yandex, and deep links for MAX while enforcing short-lived cryptographic state values and HttpOnly session cookies. Additional measures include consent checkboxes required by Russian law and polling-based result delivery to support browser, WebView and extension environments. The same architecture was reused for Home Assistant smart-home login, demonstrating reusable separation of identity and channel concerns.
Compliant Telegram Mini App Authentication via Russian ID Providers in My Anti-Social Network Project
The project 'My Anti-Social Network' demonstrates a production-grade approach to Telegram Mini App authorization that meets Russian identification requirements by separating user identity from delivery channels. Instead of relying solely on Telegram initData verification, the system routes authentication through VK ID, Yandex ID, and MAX using OAuth 2.0 / 2.1 flows with PKCE. Sensitive tokens never reach the browser; the client receives only short-lived one-time codes exchanged for HttpOnly session cookies. The architecture supports multiple front-ends including PWA, browser extensions, and Home Assistant integration while maintaining cryptographic protections around state parameters and code verifiers. The solution was implemented for an aggregator delivering personalized news feeds through Telegram, MAX, VK bots, and voice assistants.
Asset Management as the Foundation of Vulnerability Management: Unknown Assets Cannot Be Protected
The article explains that asset management forms the essential base for any effective vulnerability management program, as organizations cannot protect systems they do not know exist. It details multiple data sources including SIEM, NTA/NDR, Active Directory, CMDB, virtualization platforms, and cloud APIs that must be combined to build a complete inventory. Key record fields such as asset criticality, responsible owner, and last successful scan date are highlighted as critical for prioritization and SLA compliance. The piece examines new Russian regulations including FSTEC Order No. 117 and Federal Law No. 58-FZ that mandate accurate asset inventories to meet monthly scanning and 24-hour critical patch requirements. International frameworks such as CIS Controls v8.1, NIST CSF 2.0, and ISO/IEC 27001:2022 are compared, emphasizing lifecycle management and reaction processes for unauthorized assets. Emerging asset types including cloud resources, SaaS services, AI systems, containers, and IoT devices are discussed as expanding the attack surface faster than organizations can track.
Ozon Data Security Team Details Audit Framework to Eliminate Paper-Only Compliance
Alena, head of the Data Security group at Ozon, describes how the company built an internal audit process that focuses on actual risk reduction instead of producing lengthy formal reports. The team examines personal data, financial records, and other sensitive information across hundreds of microservices while checking role-based access, logging, encryption, and data flows. They analyzed more than 84,000 user-role pairs in one review and identified overly broad permissions on product tagging that could cause major financial losses. A notable case led to the removal of customer names, phones, and addresses from delivery boxes even though the practice was formally allowed under Federal Law 152-FZ. The group uses a scoring model based on data sensitivity, business importance, user count, and potential monetary impact to prioritize which systems to audit first. Additional criteria such as past incidents and critical information infrastructure status can be added to the model. The approach emphasizes real implementation of recommendations, cross-team communication, and hiring analysts who care deeply about practical security outcomes.