Security card: Russia wants to increase production of ultra-secure software and hardware

The authorities want to increase the market for highly tamper-proof domestic software and IT equipment by eight times by 2030 — up to 25 billion rubles. This follows from the roadmap for its development, approved by the Presidium of the Board of the Commission for Economic Modernization. It is expected that such IT products, such as operating systems, will be protected from cyber attacks at the design stage, which will reduce the risks of hacking, including from abroad. But experts believe that such plans are unrealistic — as the experience of previous projects shows, there are few successful examples of import substitution in the IT industry.

What is constructive safety?

The Russian market for constructive safety solutions may grow from 3 billion rubles in 2026 to 25 billion by 2030. "" This follows from the "Safenet" roadmap of the National Technology Initiative, the presentation of which was reviewed by Izvestia.

The document also provides for the development of cryptographic protection, trusted hardware and a domestic electronic component base. The roadmap was developed by the NTI "Safnet" working group. It was approved by the Presidium of the government Commission for Economic Modernization and Innovative Development of Russia.

The number of companies producing IT solutions in the field of constructive security is planned to increase from five to 50, according to the materials for the roadmap. To do this, it is proposed to develop principles and methods of constructive safety, create the necessary regulations and standards, as well as secure architectures and technologies. In addition, it is planned to test the technique at critical infrastructure facilities. According to the document, the Ministry of Industry and Trade should oversee this area. At the same time, there are no specific financial support measures for IT developers in the roadmap presentation.

Constructive security is an approach in which protection is embedded in the product from the very beginning, as a supporting structure in a building, and not added later in the form of antiviruses and firewalls, explained Igor Bederov, founder of "Internet Search".

— In international practice, this is Secure by design, and the term "constructive security" has become established in our country. This is critically important for Russia for three reasons. The first is import substitution. We can no longer buy ready-made Western operating systems and processors with a guarantee that there are no bookmarks in them. This means that you need to design your systems so that even potentially unsafe components cannot cause harm. The second reason is the cost of the mistake. When high—risk facilities are under the control of the software, vulnerability is not just a fine, but a threat to life and the environment. And the third is the export potential," the expert believes.

Constructive security makes it possible to reduce the number of vulnerabilities in IT systems, which means reducing the cost of constant software updates and the work of security services, Igor Bederov noted. According to him, this approach allows you to create secure systems even from components whose reliability is not guaranteed. This is especially important when some electronics have to be purchased in Asian countries.

The main idea is to create secure software and hardware systems using both domestic and foreign components, said a source familiar with the developers of the roadmap. It is now unrealistic to completely abandon imported solutions, such as Intel or NVIDIA. Therefore, it is proposed to reduce risks due to the architecture features of the systems.

In particular, it is necessary to protect the equipment from the so-called SMS death, a remote command that can completely disable it, the "Izvestia" interlocutor explained. According to him, there have already been cases when Western manufacturers, after the imposition of sanctions, remotely turned off equipment that had been serviced for 20-30 years.

Constructive security complements existing information security tools and makes it possible to more effectively manage the risks associated with the use of complex technological chains, the Ministry of Finance noted. In particular, it creates additional opportunities for monitoring the integrity and trusted operation of the software and hardware complex, as well as for timely identification and neutralization of potential threats, they explained.

"Izvestia" also sent inquiries to the NTI and the Ministry of Industry and Trade.

Let's go our own way: Russian search engines will not abandon classic links following Google

The massive transformation of information services using AI in Runet has not yet been discussed.

What ultra-secure IT products are produced in the Russian Federation

Leonid Konik, a partner at ComNews Research, said that issues related to the development of the software and hardware market that meet the requirements of constructive safety are also being addressed in other countries. For example, the US National Cybersecurity Strategy 2023 states that "every technology provider should... to take responsibility for ensuring the safety of their products at the design stage."

— The world has already moved on, and the Secure by design approach has been opposed by the concept of Secure by default. In this case, the developer guarantees that his product is configured in the most secure way, including it does not have connected services that are not needed for the usage scenario and requires two—factor authentication," the expert noted.

Developments in the field of constructive safety already exist in Russia. According to Igor Bederov, Kaspersky Lab has created the "Kaspersky microkernel" operating system, and also released the Kaspersky Thin Client, the Kaspersky Automotive Secure Gateway gateway for cars, and solutions for the industrial Internet of Things. "Astra Group" and "Aladdin" are also starting to implement the principles of safe development. We are talking about embedding cryptographic protection directly into the core of the Astra Linux operating system.

— But there is no mass market yet, since most vendors either only declare their intentions or are at the pilot stage. For Russia, this means that the window of opportunity is open, but we need to hurry before competitors from friendly countries occupy a niche," Igor Bederov added.

Dmitry Satanin, Director of Information Security at "Astra Group", noted that constructive security is actually the only way to protect the most widespread class of software and hardware complexes today — Internet of Things (IoT) devices. Their number is already in the tens of billions. According to him, it is almost impossible to use the usual, additionally installed security features for such devices.

""Izvestia" also sent a request to "Kaspersky Lab".

Vladimir Vysotsky, Head of the Solar appScreener Business Development Department, believes that the direction of the roadmap is fully consistent with current government strategies. According to him, the document is based on materials prepared within the framework of the government commission on economic modernization and technological development. Constructive security allows you to eliminate vulnerabilities that cannot be fixed with regular updates, as well as helps you meet regulatory requirements and reduce the cost of operating IT products. According to the expert, it is 10-100 times cheaper to fix the architecture of the system at the development stage than to eliminate the consequences of a cyberattack after its implementation.

Showcase of sovereignty: what will quotas give for Russian goods on marketplaces?

The bill on the "Russian shelf" will strengthen the position of domestic products, but may complicate the lives of small market players.

How realistic are the plans

Russia regularly tries to create new IT products, develop import substitution and reduce dependence on foreign software and equipment. However, most domestic solutions are still inferior to their foreign counterparts and are not in high demand on the mass market, said Denis Kuskov, CEO of TelecomDaily.

According to the expert, adapted foreign solutions are often passed off as Russian developments. Domestic mobile operating systems, office suites and other products are still noticeably lagging behind the world's leading analogues in terms of development, he believes.

The idea sounds beautiful, but it is very idealistic, Leonid Konik also noted. It's like announcing the creation of a lock that has absolute burglar resistance at the design stage. But until now, even the most sophisticated new lock sooner or later had a key to open it, he pointed out.

— Among the main directions of the roadmap is the use of trusted AI at all stages of design and development. It sounds bravura, but so far in practice all Russian companies, including state-owned ones, are widely using AI models from the USA and China," the expert says.

In his opinion, it is much more reasonable to discuss ways to combat penetration into corporate and government information systems, rather than lull their owners to sleep with stories about "truly secure" IT solutions, Leonid Konik concluded.