The national cyber threat knowledge base.
Threat analyses, checklists and response procedures. Written for practitioners: no marketing, concrete actions and an explicit list of what not to do.
The first 15 minutes after you discover a breach
The most expensive stretch of an incident. Most evidence is destroyed not by the attacker but by the defender, with the best of intentions.
Why you must not power the machine off
An administrator’s first reflex is to cut power to the server. That is a mistake. Memory holds encryption keys, decrypted configurations, active network connections, processes with no file on disk and traces of fileless attacks. Powering off destroys all of it irreversibly and leaves the investigation without half its evidence.
The right move is network isolation without shutting down: disable the segment on the switch, remove the VLAN, physically unplug the cable. The attacker loses control and memory stays alive.
The sequence
- 00:00
Record the time
The exact time of discovery, who found it and by what sign. Write it down outside the compromised system — on paper or in a separate environment. Anything recorded inside an infected system cannot be trusted.
- 00:02
Isolate without shutting down
Cut the segment off the network. Do not reboot, do not kill suspicious processes, do not delete files.
- 00:05
Capture a memory image
Dump RAM before doing anything else. Then image the disk. Record the image hashes immediately, otherwise their evidential value is lost.
- 00:10
Preserve the logs
Copy system, application, network device and security tool logs to external media. Logs rotate often — in a day they may be gone.
- 00:12
Notify
The responsible officer in your organisation and the STS. Under the Digital Code the deadline for reporting a personal data breach is measured in hours — the clock is already running.
- 00:15
Map the perimeter
Work out which other systems had network connectivity to the affected one and used the same credentials. A compromised account means every system it worked on is compromised.
What you must not do
Do not let antivirus “clean” anything before images are taken — it will delete the malware samples. Do not reinstall the system: that destroys evidence, it does not restore anything. Do not clear logs. Do not change passwords on the compromised machine — the new password will go straight to the attacker; change them from a clean environment. Do not announce the breach in shared work chats: if the attacker can read them, you have just told them to cover their tracks.
Post-quantum cryptography: why prepare now
There is no quantum computer capable of breaking RSA yet. You still need to prepare — here is why.
The “harvest now, decrypt later” attack
The key argument is not that encryption will be broken tomorrow. Traffic intercepted and stored today can be decrypted in ten or fifteen years, once a powerful enough quantum machine exists. Anything that must stay secret for longer than that — state secrets, personal data, medical records, banking secrecy — is already vulnerable at the moment of transmission.
That reframes the question: it is not “when will it be broken” but “how long must your data stay closed”. If the answer is more than ten years, migration is needed today.
What exactly breaks
Shor’s algorithm devalues public-key cryptography based on factorisation and discrete logarithms: RSA, DSA, elliptic-curve schemes. Symmetric ciphers suffer less: Grover’s algorithm roughly halves their strength, which is offset by doubling the key length. AES-256 remains acceptable; AES-128 does not.
Where to start
- 01
Cryptographic inventory
Compile a list: where and which algorithms are used, what key lengths, where they are baked into hardware and cannot be updated without replacing it. Most organisations do not know the answer — and that is the first problem.
- 02
Assess data lifetime
For each class of data, define how many years it must remain confidential. That sets the migration order.
- 03
Crypto-agility
Design systems so the algorithm can be swapped without rewriting the application. A hard-coded algorithm is the main debt in any migration.
- 04
Hybrid schemes
The transition period assumes running a classical and a post-quantum algorithm together: protection holds even if one of them turns out to be weak.
The institute is drafting a national standard on post-quantum cryptographic algorithms. You can follow its status in the “Standards”.
AI on both sides: what it actually changed
Without exaggeration in either direction. What really changed in attack and defence, and what stayed the same.
What changed in attack
The main shift is not new attack types but the cost and quality of the old ones. A phishing email in correct Kazakh or Russian, in proper business style and with the context of a specific organisation, used to require time and language skills. Now it is generated at scale. The classic advice to “look for mistakes in the text” has stopped working.
Second is voice cloning. A convincing imitation of an executive’s voice can be built from a few seconds of recording found in open sources. The “the director called, transfer the money urgently” scheme has reached a new level. The defence here is procedural, not technical: confirmation of transactions through an independent channel, mandatory for everyone with no exceptions by seniority.
Third is faster reconnaissance and exploit writing. The barrier to entry has dropped: what used to require skill is now available to less prepared attackers.
What did not change
The initial intrusion vector is unchanged: stolen credentials, an unpatched perimeter, exposed RDP, a misconfiguration. AI has not repealed basic hygiene; it has only made bypassing its absence cheaper. An organisation without multi-factor authentication and patch management will be breached whether or not the attacker used neural networks.
A new attack surface
By deploying AI internally an organisation acquires threats it did not have before: prompt injection, where the model follows instructions found in the document it is processing; training data poisoning; leakage of confidential information through employee prompts into external services. A model with access to internal systems is an account with privileges and must be treated as such.
AI in defence
It works where an anomaly must be found in a large stream of events: behavioural analytics, alert triage, reducing first-line routine. It does not work as a replacement for a specialist — without a human who understands the context, the system produces either noise or false calm.
OSINT: what your organisation looks like from outside
An analysis is in preparation: what data an organisation reveals about itself through certificates, DNS, document metadata, job adverts and employee profiles.
It will appear in an upcoming update of the knowledge base.
Self-assessment checklists
Work through them before the inspection arrives. Downloadable files will appear once the templates are approved.
Documents, threat model, procedures and logs for owners of CDA. The procedure is in the FAQ.
Legal grounds for processing, retention periods, data subject rights under the Digital Code.
Is there a procedure, are responsible officers appointed, has the scenario been rehearsed in practice.
An inventory of the algorithms in use and an assessment of data lifetime.