Questions and Answers

A firewall is a virtual checkpoint that filters incoming and outgoing traffic, letting only safe data through and blocking threats. It works like a security guard: checks data packets, verifies them against the rules and decides whether to allow or block. Integration with SIEM and SOC provides comprehensive protection. The installation service will help you deploy a firewall in your network.

Source: term "Firewall (network firewall)"

A firewall is a computer network security system that restricts the passage of incoming, outgoing and intra-network traffic. It is a software or hardware-software tool that decides whether to allow or block a data packet. Modern firewalls integrate with SIEM and NGFW for deep traffic analysis. The installation service will help you configure a firewall.

Source: term "Firewall (network firewall)"

A firewall is installed at the boundary between the organization's internal network and external networks (usually the Internet). It can also be placed inside the corporate network in front of segments with confidential data. Firewalls can be hardware (installed in server racks) and software (on servers and workstations). The installation service will help you correctly place and configure a firewall in your infrastructure.

Source: term "Firewall (network firewall)"

A router forwards data between networks, directing packets in the right direction, but does not analyze their contents. A firewall filters traffic and prevents attacks, making decisions based on security rules. Modern firewalls integrate with NGFW and SIEM. The installation service will help you choose and configure the right solution.

Source: term "Firewall (network firewall)"

A firewall is also called an edge firewall, security firewall or network firewall. All these terms denote the same protection tool — a network traffic filtering system. Modern solutions include NGFW (next-generation firewalls) with extended functions. The installation service will help you deploy a firewall in your organization.

Source: term "Firewall (network firewall)"

Examples of firewalls: hardware — Cisco ASA, FortiGate, Check Point; software — UserGate, pfSense, OPNSense; built-in — Windows Firewall, iptables in Linux. Modern NGFW solutions combine filtering with IPS, antivirus and application control. The installation service will help you choose and configure the optimal solution for your network.

Source: term "Firewall (network firewall)"

A firewall protects a computer network from unauthorized access, port scanning, network attacks and malware. It controls network traffic, blocks suspicious connections and prevents data leaks. Integration with SIEM and SOC provides comprehensive security monitoring. The installation service will help you properly configure protection. To study related concepts, we also recommend reading about Captcha, DDoS attack, Unauthorized access and Sandbox.

Source: term "Firewall (network firewall)"

DLP (Data Loss Prevention) is a system that prevents employees from accidentally or deliberately taking secret data outside the company. It controls correspondence in messengers and email, blocks sending files to flash drives and cloud storage, and also records suspicious actions. DLP helps comply with the requirements of 152-FZ on personal data. Read more about protection approaches in the technologies section.

Source: term "DLP system (data loss prevention)"

A DLP system (Data Loss Prevention) is software for protecting corporate information from leaks and unauthorized access. It controls all communication channels: email, messengers, social networks, cloud storage, USB flash drives and document printing. When confidential data is detected, the system blocks the transfer and notifies the security service. DLP systems integrate with SIEM and CIPF. Learn more about data protection in the technologies section.

Source: term "DLP system (data loss prevention)"

DLP and SIEM are different classes of security systems. DLP prevents internal data leaks by controlling the transfer of confidential information. SIEM collects and analyzes security events from the entire IT infrastructure to detect cyber attacks. In a modern infrastructure, DLP and SIEM work in tandem: DLP blocks leaks, and SIEM records violation attempts. Both systems integrate with SOC for prompt response. Read more about protection in the technologies section.

Source: term "DLP system (data loss prevention)"

Popular on the Russian market are InfoWatch Traffic Monitor, Solar Dozor, SearchInform KIB, StaffCop Enterprise and Garda DLP. Among international solutions are Microsoft Purview, Forcepoint DLP and Symantec DLP. When choosing DLP, it is important to consider integration with SIEM and compliance with 152-FZ requirements. The design service will help you choose the optimal solution for your organization.

Source: term "DLP system (data loss prevention)"

DLP systems are classified by architecture: network (control traffic at the network boundary), agent-based (installed on workstations) and hybrid. By analysis method they are divided into content-based (check file contents), contextual (analyze transfer conditions) and behavioral (track anomalies in user actions). Full-featured platforms integrate with SIEM and CIPF. Read more about the choice in the technologies section.

Source: term "DLP system (data loss prevention)"

DLP is primarily software. It can be implemented as agent software on end devices (laptops, workstations) and as network sensors to intercept traffic at gateways. In some cases, hardware accelerators are used to process large amounts of data, but the basis of DLP is a software platform. To protect data, DLP integrates with CIPF and access control systems. Learn more in the technologies section.

Source: term "DLP system (data loss prevention)"

The DLP (Data Loss Prevention) process includes three stages: data collection (interception of traffic and user activity), analysis (content, contextual or behavioral) and response (blocking transfer, warning or recording an incident). Modern DLP systems use machine learning to identify anomalies. For comprehensive protection, DLP integrates with SIEM and SOC. Read more about implementation in the our services section.

Source: term "DLP system (data loss prevention)"

SIEM is a system that collects all security events from the entire company's IT infrastructure (logs of servers, firewalls, antiviruses), analyzes them and alerts about suspicious activity. It is like a security control center that sees what is happening across the network. SIEM helps detect attacks that are individually unnoticeable. For comprehensive protection, SIEM integrates with SOC and DLP systems. Learn more about monitoring approaches in the technologies section.

Source: term "SIEM system"

DLP and SIEM are different classes of security systems. DLP prevents internal data leaks by controlling the transfer of confidential information (email, messengers, USB). SIEM collects and analyzes security events from the entire IT infrastructure to detect cyber attacks. DLP blocks data transfer, SIEM alerts analysts about threats. In a modern infrastructure they work in tandem: DLP sends data to SIEM for comprehensive analysis. Read more about protection in the technologies section.

Source: term "SIEM system"

SIEM (Security Information and Event Management) is a software platform for collecting and analyzing security events. SOC (Security Operations Center) is a monitoring and incident response center where analysts work using SIEM as their main tool. SIEM is a technology, SOC is a team and processes. For effective SOC operation, integration with SIEM and other systems is necessary. The design service will help you organize a SOC in your company.

Source: term "SIEM system"

There are no fully free ready-made SIEM systems. However, there are powerful open source solutions: Wazuh, ELK Stack, Security Onion. They require self-configuration and do not have ready-made correlation rules. There are conditional free versions (for example, Splunk Free with a data volume limit). For government information systems and CII facilities, it is recommended to use commercial SIEM solutions. The design service will help you choose the optimal solution.

Source: term "SIEM system"

The essence of SIEM is the centralized collection, normalization and correlation of security events from all devices and systems of the company. SIEM aggregates logs, brings them to a unified format, analyzes relationships and identifies anomalies. When suspicious activity is detected, the system alerts SOC analysts. SIEM also provides long-term data storage for investigations and compliance with regulatory requirements. Read more about protection in the technologies section.

Source: term "SIEM system"

On the Russian market: MaxPatrol SIEM (Positive Technologies), Kaspersky Unified Monitoring and Analysis Platform, RuSIEM, Ankey SIEM, KOMRAD Enterprise SIEM. International solutions: Splunk Enterprise Security, IBM QRadar, ArcSight. When choosing SIEM, it is important to consider integration with SOC and compliance with 187-FZ requirements for CII facilities. The design service will help you choose the optimal solution.

Source: term "SIEM system"

No. SIEM is a class of systems for managing security information and events. Splunk is a specific product that can be used as a SIEM platform (Splunk Enterprise Security). Splunk is one implementation of the SIEM approach, along with IBM QRadar, ArcSight and Russian solutions. For CII facilities in Russia, it is recommended to use domestic SIEM solutions. Read more about the choice in the technologies section.

Source: term "SIEM system"

SOC (Security Operations Center) is a security monitoring center that monitors the company's IT infrastructure around the clock, detects hacker attacks and protects data. It is like a security service, but in the digital world. A SOC uses SIEM systems to collect events and alerts analysts about threats. A SOC can be organized as an internal department or as an outsourced service. Learn more about protection in the technologies section.

Source: term "SOC (Security Operations Center)"

The SOC abbreviation has several meanings. In the field of information security and cybersecurity — Security Operations Center (a center for monitoring and responding to cyber incidents). In electronics — System on a Chip. In energy — State of Charge (battery charge level). In the context of our activities, a SOC is an information security monitoring center that uses SIEM and other tools. Read more about SOC in the technologies section.

Source: term "SOC (Security Operations Center)"

In the context of PCs and electronics, SOC (System-on-a-Chip) is a single microchip that combines a central processor, graphics processor, modem and controllers. Examples: Apple M-series chips, Snapdragon, MediaTek. In information security, SOC means Security Operations Center — a security monitoring center. In the context of our activities, a SOC is an information security center that uses SIEM to protect IT infrastructure. Learn more in the technologies section.

Source: term "SOC (Security Operations Center)"

SOC (Security Operations Center) is a center for monitoring and responding to incidents where security analysts work. SIEM (Security Information and Event Management) is a software platform that collects and analyzes security events. SIEM is the main tool used by a SOC for monitoring. A SOC includes people, processes and technologies, and SIEM is one of the key technologies in a SOC. The technical support service helps organize a SOC.

Source: term "SOC (Security Operations Center)"

In Russia, a SOC is a department responsible for 24/7 monitoring and protection of an organization's IT infrastructure. The main task of a SOC is proactive detection, analysis and response to cyber threats. For CII facilities and government information systems, the creation of a SOC is recommended by regulators. More than 90% of large organizations in Russia plan to create their own SOCs or use MSSP services. Read more about approaches in the technologies section.

Source: term "SOC (Security Operations Center)"

Analysts of three levels work in a SOC. L1 (first level) are primary triage operators who process alerts from SIEM and classify incidents. L2 (second level) are analysts for in-depth investigation and response. L3 (third level) are threat hunting, forensic analysis and correlation rule development experts. To train analysts, we offer training services.

Source: term "SOC (Security Operations Center)"

The salary of a SOC analyst depends on the skill level and region. In Moscow and St. Petersburg, an L1 analyst can earn from 80,000 to 150,000 rubles, L2 — from 150,000 to 250,000 rubles, L3 — from 250,000 rubles and above. The demand for SOC analysts in Russia is constantly growing, especially in connection with the requirements of 187-FZ for CII facilities. The training service helps prepare specialists for working in a SOC.

Source: term "SOC (Security Operations Center)"

PKI stands for Public Key Infrastructure. It is a set of technologies, processes and policies for managing digital certificates and cryptographic keys. PKI ensures secure data exchange and authentication in networks. In Russia, PKI must use certified CIPF. Read more about the components in our glossary.

Source: term "PKI (Public Key Infrastructure)"

PKI (Public Key Infrastructure) is a set of policies, technologies and hardware tools for creating, managing, storing and revoking digital certificates. PKI is based on asymmetric encryption: the public key is available to everyone, the private key is only to the owner. A digital certificate connects the public key to a specific user. The design service helps implement PKI in your organization. Learn more about data protection in the technologies section.

Source: term "PKI (Public Key Infrastructure)"

A PKI certificate (digital public key certificate) is a digital document that connects a public cryptographic key to a specific owner. It acts as a digital identity card. The certificate is signed by a certification authority (CA) that guarantees authenticity. In Russia, certificates must comply with CIPF requirements. Read more about security in the technologies section.

Source: term "PKI (Public Key Infrastructure)"

PSK (Pre-Shared Key) uses a single common secret to authenticate all devices in a group. PKI assigns each device a unique digital identifier (a certificate from a trusted certification authority). PKI is more secure and scalable, but more complex to implement. In Russia, PKI must use certified CIPF. The design service will help choose the optimal approach.

Source: term "PKI (Public Key Infrastructure)"

No, these are different concepts. SSL (Secure Sockets Layer) is an encryption protocol that uses a certificate to protect the connection between a client and a server. PKI is an infrastructure for managing certificates and keys that underlies SSL/TLS. PKI is broader in functionality: it includes certificate management, signatures, encryption and authentication. In Russia, PKI must use CIPF. Read more about security in the technologies section.

Source: term "PKI (Public Key Infrastructure)"

The four main principles of PKI: secure storage of private keys (tokens); verification of the user's identity (registration authority); issuance and signing of certificates (certification authority); storage and revocation of certificates (certificate management system). These components ensure trust in the digital environment. In Russia, all PKI components must comply with CIPF requirements. The design service will help implement a full PKI infrastructure.

Source: term "PKI (Public Key Infrastructure)"

PKI provides the necessary tools for data encryption, authentication and protection against unauthorized access. It is used for SSL/TLS, electronic signatures, secure mail and VPN. In Russia, PKI must use certified CIPF and comply with the requirements of the FSB of Russia. The design service helps design and implement a reliable PKI infrastructure.

Source: term "PKI (Public Key Infrastructure)"

NGFW (Next-Generation Firewall) is a next-generation firewall that combines the functions of a traditional firewall with deep packet inspection (DPI), an intrusion prevention system (IPS) and application control. Unlike a classic firewall, it analyzes traffic at the application layer and can identify applications and block threats regardless of ports and protocols.

Source: term "NGFW (next-generation firewall)"

An NGFW inspects traffic at all levels of the OSI model. In addition to traditional packet filtering, it performs deep packet inspection (DPI), identifies applications by signatures and behavioral analysis, detects and blocks attacks in real time with an intrusion prevention system (IPS), filters URLs and scans traffic for malware.

Source: term "NGFW (next-generation firewall)"

NGFW is used to protect the network perimeter, segment internal networks and protect data centers. It is deployed at the boundary between the corporate network and the Internet, as well as in front of segments with confidential data. In government information systems, the use of NGFW must comply with the requirements of the FSTEC of Russia.

Source: term "NGFW (next-generation firewall)"

NGFW provides a higher level of protection compared to classic firewalls: deep packet inspection (DPI), an intrusion prevention system (IPS), application control regardless of ports and protocols, antivirus traffic inspection, URL and web content filtering, and DDoS protection. This allows detecting and blocking modern threats that traditional firewalls miss.

Source: term "NGFW (next-generation firewall)"

The requirements for NGFW in Russia depend on the type of facility being protected. In government information systems, the use of NGFW must comply with the requirements of the FSTEC of Russia. For critical information infrastructure (CII) facilities, the requirements of 187-FZ apply. It is recommended to use certified solutions and integrate NGFW with SIEM and SOC.

Source: term "NGFW (next-generation firewall)"

NGFW differs from a traditional firewall by its ability to inspect traffic at the application layer. A classic firewall filters packets by addresses and ports, while NGFW performs deep packet inspection, identifies applications by signatures and behavior, and combines IPS, antivirus and URL filtering in one device. This makes it more effective against modern threats.

Source: term "NGFW (next-generation firewall)"

To implement an NGFW in an organization, you need to: 1) choose a solution that meets the security requirements, 2) develop a security policy and filtering rules, 3) deploy the NGFW at the network boundary and configure traffic segmentation, 4) integrate it with SIEM and SOC for monitoring. The installation service includes NGFW deployment and configuration.

Source: term "NGFW (next-generation firewall)"

According to 152-FZ, personal data (PD) is any information that relates directly or indirectly to a specific individual. This includes identification data (full name, date of birth, place of birth), contact data (phone, address, email), passport data, TIN, SNILS, as well as digital traces (IP address, geolocation, cookies) and even photographs or voice if a person can be identified by them. A special category is formed by biometric data (fingerprints, face, voice), which requires enhanced protection and the mandatory use of CIPF tools during processing.

Source: term "152-FZ "On Personal Data""

152-FZ is a law that protects your personal information. It obliges any organization (bank, online store, government body) to ask for your consent to collect data, store it confidentially and protect it from leaks, and also delete it on first request. Serious fines are provided for violating the law, up to turnover fines of 3% of annual revenue for companies.

Source: term "152-FZ "On Personal Data""

Serious liability is provided for violating 152-FZ. This includes administrative fines (up to 700 thousand rubles for processing without consent), turnover fines for data leaks (up to 3% of annual revenue, but not less than 1 million rubles) and even criminal liability under Article 137 of the Criminal Code of the Russian Federation (imprisonment for up to 5 years). Website blocking and disqualification of officials are also possible. To avoid these risks, it is necessary to use certified protection tools such as CIPF and undergo regular security audits.

Source: term "152-FZ "On Personal Data""

The consent of the subject is not required when data processing is necessary for the execution of a contract (for example, placing an order in a store), compliance with legal requirements (submitting reports to the tax authority), protecting the life and health of a person, as well as for the administration of justice. The full list of exceptions is specified in Article 6 of 152-FZ. In these cases too, the operator is obliged to ensure data confidentiality and use the necessary protection measures, including CIPF tools when transferring data.

Source: term "152-FZ "On Personal Data""

Significant amendments to 152-FZ came into force on July 1, 2025: a ban was introduced on the use of foreign services (databases, cloud storage) for the primary collection and storage of data of Russians. Data collection through foreign web analytics is also considered a violation. Now businesses are obliged to use exclusively Russian infrastructure included in the Register of Domestic Software. Turnover fines for data leaks have also been increased — up to 3% of annual revenue.

Source: term "152-FZ "On Personal Data""

A personal data operator is any legal or natural person who organizes and carries out data processing, determining its purposes and composition. These can be government bodies, banks, online stores, employers, medical institutions and any other structures. The operator is charged with the obligation to ensure the security of systems, for which firewalls, SIEM systems and DLP systems are used. You can check whether you are an operator and learn about the procedure on the Roskomnadzor website.

Source: term "152-FZ "On Personal Data""

To comply with 152-FZ, it is necessary to complete several key steps: submit a notification to Roskomnadzor, obtain the consent of subjects for processing (in written or electronic form), publish a Privacy Policy on the website, and ensure data storage on the territory of the Russian Federation using Russian services from the Register of Domestic Software. It is also critically important to implement technical protection tools: DLP systems to prevent leaks, CIPF tools for encryption and SIEM systems for incident monitoring. Regular audit and design of secure systems will help avoid fines.

Source: term "152-FZ "On Personal Data""

CII (critical information infrastructure) is information systems, telecommunication networks and automated control systems used in vital spheres of the state. Law 187-FZ obliges government bodies and companies from critical sectors (banks, transport, communications, energy, healthcare) to protect their systems from cyber attacks and report computer incidents. To fulfill the requirements of the law, it is necessary to use certified CIPF tools and other protection measures.

Source: term "187-FZ "On the Security of Critical Information Infrastructure""

187-FZ is a law that obliges vital organizations to protect their computers, networks and databases from cyber attacks. Its main goal is to prevent hackers from turning off the electricity, stopping trains, hacking hospitals or disrupting the work of banks. The law requires companies to categorize systems, implement protection and report attacks to the FSTEC and the FSB. Firewalls and intrusion detection systems are used to protect CII facilities.

Source: term "187-FZ "On the Security of Critical Information Infrastructure""

A CII entity is obliged to categorize facilities and send the results to the FSTEC, create a security system using certified tools, implement technical protection measures (access control, encryption, antivirus protection), and also report computer attacks and interact with GosSOPKA. It is recommended to use SIEM systems and DLP solutions to ensure the security of CII facilities.

Source: term "187-FZ "On the Security of Critical Information Infrastructure""

Government bodies and Russian legal entities that own information systems in critically important sectors fall under the scope of the CII law: healthcare, transport, communications, energy, banking, defense, nuclear, mining, metallurgical and chemical industries. Individual entrepreneurs are excluded from this list. Biometric systems and access control systems (ACS) are used to identify and authenticate users at CII facilities.

Source: term "187-FZ "On the Security of Critical Information Infrastructure""

187-FZ establishes three categories of CII facility significance. The first category — facilities whose security breach could lead to an emergency of federal scale. The second category — facilities whose accident creates a threat on a regional scale. The third category — facilities whose incidents could cause damage on the scale of a municipality. Particularly significant facilities for defense and security are also distinguished. Various cryptographic protection tools are used to protect facilities of different categories.

Source: term "187-FZ "On the Security of Critical Information Infrastructure""

A CII facility is information systems, information and telecommunication networks and automated control systems of critical information infrastructure entities. These include process control systems (SCADA), databases, data transmission networks and other equipment that ensures the functioning of critical sectors. Certified tools, including firewalls and access control systems, are needed to protect such facilities.

Source: term "187-FZ "On the Security of Critical Information Infrastructure""

Amendments to 187-FZ tightening CII security requirements come into force on September 1, 2025. Mandatory certification of protection tools for all categories of facilities is introduced, requirements for incident monitoring and interaction with GosSOPKA are strengthened. The list of facilities subject to mandatory certification is also expanded. A ban on the use of foreign software at CII facilities is introduced (except for cases where there are no domestic analogues). To prepare for the changes, it is recommended to undergo certification of CII facilities. Read more about government regulation of the industry in the article Government regulation in IT.

Source: term "187-FZ "On the Security of Critical Information Infrastructure""

SKZI are programs or devices that encrypt data and create electronic signatures. They turn ordinary data into unreadable code, protecting it from theft and forgery. SKZI are used in electronic document management, bank transfers and secure communications. The SINTEZM product is a certified SKZI for electronic signatures and encryption. The research service will help you choose the optimal SKZI.

Source: term "SKZI (cryptographic information protection tool)"

SKZI (cryptographic information protection tools) are hardware, software and software-hardware complexes for data encryption, protection against unauthorized access and creating electronic signatures. In Russia, all SKZI are subject to FSB certification. The SINTEZM product is a certified SKZI. The research service will help you select the optimal solution.

Source: term "SKZI (cryptographic information protection tool)"

Examples of software SKZI: CryptoPro CSP, ViPNet CSP, Kontur.Kripto, and the SINTEZM product. Hardware SKZI: Rutoken, JaCarta. Software-hardware: ViPNet Coordinator, CryptoPro HSM. In Russia, only SKZI certified by the FSB are allowed for use. The research service will help you choose the optimal solution for your tasks.

Source: term "SKZI (cryptographic information protection tool)"

SKZI in a tachograph is a cryptographic information protection tool, a special cryptographic chip that encrypts data about the speed, mileage and route of a vehicle. The SKZI unit protects against data forgery, supports the operation of driver cards with an electronic signature and records coordinates via GLONASS/GPS. The service life of the SKZI unit is 3 years. The SINTEZM product is an example of software SKZI.

Source: term "SKZI (cryptographic information protection tool)"

The SKZI class is determined according to FSB Order No. 378, based on the type of threats, the level of significance and the scale of processed data. Classes: KS1 (protection against external threats), KS2 (protection against internal threats), KS3 (high protection), KV (for government systems), KA (maximum class). The class is indicated in the documentation and the FSB certificate. The SINTEZM product has an FSB certificate. The research service will help determine the required class.

Source: term "SKZI (cryptographic information protection tool)"

Only authorized employees who have completed training and gained access to encryption keys and electronic signatures are allowed to work with SKZI. They must comply with operating rules, keep keys secret and promptly detect hacking attempts. The SINTEZM product is a certified SKZI for corporate use. The training service will help prepare employees.

Source: term "SKZI (cryptographic information protection tool)"

A SKZI user is prohibited from: transferring keys to third parties, disclosing passwords from media, leaving media unattended, creating backup copies of keys without approval, making changes to SKZI software, and using work keys on personal computers. Violation of the rules entails liability. The SINTEZM product is a certified SKZI with clear operating rules.

Source: term "SKZI (cryptographic information protection tool)"

The fastest way is to obtain a free signature through the Gosklyuch application (a verified Gosuslugi account is required). For business (LLC/IE), the most reliable method is to contact the Certification Authority of the Federal Tax Service of Russia or its trusted representatives. You can also obtain a QES at commercial accredited certification authorities such as Kontur or Tensor. Working with a signature will require a cryptographic information protection tool, for example CryptoPro CSP.

Source: term "Electronic signature (ES)"

Information about electronic signature certificates issued in your name can be found in the personal account of the Gosuslugi portal in the "Profile" — "Electronic signature" section. The physical signature file (private key) is stored on a protected medium (token) or in the register of the certification authority. If you cannot find your signature, contact the CA where it was issued.

Source: term "Electronic signature (ES)"

Yes, through Gosuslugi it is easiest to obtain a non-qualified (ENES) or qualified electronic signature (QES) using the official Gosklyuch application. The process is free and remote. For a QES, you will need to confirm your identity (through biometrics with a new-format foreign passport or in person at an MFC). This is a convenient way to obtain a legally significant signature for personal needs and business.

Source: term "Electronic signature (ES)"

An electronic signature does not have a single visual appearance. In PDF and Word, it can look like a rectangular stamp with information about the owner, date and time of signing. It can also be represented as a separate file with the extension .sig, .sgn or .p7s. The signature itself is not a picture, but a set of cryptographic data confirming authorship. Its authenticity is verified using public key infrastructure (PKI).

Source: term "Electronic signature (ES)"

Electronic signatures are issued by accredited certification authorities (CAs). For heads of organizations and individual entrepreneurs, a signature is issued free of charge at the CA of the Federal Tax Service of Russia. For individuals and employees of organizations — at commercial accredited CAs (for example, Tensor, SKB Kontur). The full list of accredited centers is published by the Ministry of Digital Development on the Gosuslugi portal. When obtaining a signature for employees, a machine-readable power of attorney from the head will be required.

Source: term "Electronic signature (ES)"

A machine-readable power of attorney (MCD) is an electronic document in XML format that confirms the authority of an employee to sign electronic documents on behalf of a legal entity. Since September 1, 2024, the MCD has become mandatory when employees use a QES. The MCD is signed with the QES of the head and is stored in the Unified MCD repository of the Federal Tax Service of Russia. This greatly simplifies the verification of authority in electronic document management.

Source: term "Electronic signature (ES)"

The validity period of a qualified electronic signature (QES) certificate is 15 months (1 year + 3 months) for most types of certificates. For individuals, the period can be up to 3 years. After the certificate expires, the signature becomes invalid — documents signed with an expired signature lose legal force. You must promptly reissue the certificate at the certification authority. We also recommend familiarizing yourself with the concept of Tokenization.

Source: term "Electronic signature (ES)"

Data encryption is the process of transforming information into unreadable code using mathematical algorithms and a key. Only users with the appropriate access key can read the data. This is the basis of security on the Internet, in e-commerce and corporate systems. For government organizations, the use of certified cryptographic information protection tools is mandatory.

Source: term "Data encryption"

There are three main methods: symmetric encryption (one key for encryption and decryption, fast, for example AES, GOST "Magma"); asymmetric encryption (a pair of keys: public and private, used for signing and key exchange, for example RSA, GOST R 34.10); hybrid encryption (a combination of symmetric and asymmetric encryption to protect session keys). In Russia, for government systems, the use of GOST algorithms implemented in certified CIPF tools is mandatory.

Source: term "Data encryption"

Data is encrypted to ensure confidentiality during storage and transmission. This protects information from theft, unauthorized access and leaks. Encryption is mandatory when transmitting payment data, personal information and trade secrets. For Russian companies, encrypting personal data is a requirement of 152-FZ.

Source: term "Data encryption"

Russia has national encryption standards approved by the FSB: GOST 28147-89 ("Magma") — a classic block cipher with a 256-bit key; GOST R 34.12-2015 ("Kuznechik") — a modern block cipher; GOST R 34.10-2012 — an electronic signature algorithm based on elliptic curves; GOST R 34.11-2012 ("Stribog") — a hashing algorithm. These algorithms are mandatory for government information systems and CII facilities.

Source: term "Data encryption"

Encrypting data on your phone is strongly recommended, as it protects your personal photos, videos, correspondence and banking data from theft in case of device loss or hacking. Modern smartphones have built-in encryption (for example, iOS and Android encrypt data by default). This is a basic protection measure that will not allow attackers to gain access to your information.

Source: term "Data encryption"

Cryptography distinguishes two main types of encryption: symmetric and asymmetric. Symmetric uses one key for encryption and decryption — fast and efficient for large amounts of data. Asymmetric uses a pair of keys (public and private) — slower but safer for exchanging data over unsecured channels. They are often combined in hybrid schemes, where asymmetric encryption protects the key for the symmetric algorithm.

Source: term "Data encryption"

Hashing is a one-way mathematical transformation of data into a string of fixed length (a hash). Unlike encryption, hashing is irreversible — it is impossible to restore the original data from a hash. Hashing is used to verify data integrity, store passwords and create digital fingerprints of files. Encryption, on the contrary, is reversible and is used to ensure data confidentiality. In Russia, the GOST R 34.11-2012 ("Stribog") standard is used for hashing.

Source: term "Data encryption"

Identification answers the question "Who are you?" — you report your login or number to the system. Authentication proves "You are really you" — you enter a password, an SMS code or scan a fingerprint. Identification is presenting yourself to the system, authentication is confirming authenticity. The Biomark and Biovizum products are used for biometric authentication. The design service will help implement an authentication system.

Source: term "Identification and authentication"

Identification is the process of recognizing and assigning a unique name (identifier) to a person or object to distinguish them from all others. In simple words, this is the answer to the question: "Who are you?" In IT, this is entering a login when accessing an account; in everyday life, it is presenting a passport. Authentication follows identification — proof that you are really who you claim to be. The Biomark and Biovizum products provide biometric identification.

Source: term "Identification and authentication"

Authentication is the verification of the authenticity of a user. The system makes sure that you are really you and not someone else. This is similar to a guard checking a passport at the entrance: you state your name (login), and the document proves that you are the owner of this name. The system checks: what you know (password), what you have (SMS code) or who you are (biometrics). The Biomark and Biovizum products provide biometric authentication.

Source: term "Identification and authentication"

The three classic authentication factors: knowledge (something you know — password, PIN code); possession (something you have — a phone for SMS codes, a hardware token); attribute (something you are — biometrics: fingerprint, face, voice). Using two or three factors is called multi-factor authentication (MFA). The Biomark and Biovizum products are used for biometric authentication. The design service will help implement MFA.

Source: term "Identification and authentication"

Authentication and identification systems are complexes of tools for recognizing users and verifying their authenticity. An example is ESIA (Unified Identification and Authentication System) on Gosuslugi. It allows citizens to use one login and password to access government services. In corporate systems, the Biomark and Biovizum products are used. The design service will help implement an identification and authentication system.

Source: term "Identification and authentication"

Identification without authentication is possible, but it does not provide security. The system will know who you are (by login), but it will not be able to confirm that you are really that person. This is like stating your name but not showing a passport — the system can be fooled. Authentication is necessary for full protection. The Biomark and Biovizum products provide reliable biometric authentication.

Source: term "Identification and authentication"

Examples of identification: entering a login when visiting a website, scanning a fingerprint to unlock a phone, presenting a passport at a bank. In psychology, identification is the process of identifying oneself with another person or group. In IT, identification is the first step of access, followed by authentication and authorization. The Biomark and Biovizum products provide biometric identification in corporate systems.

Source: term "Identification and authentication"

Verification is the checking of authenticity or confirmation of data. In simple words, it is a process that proves that you are you, and that the information provided or documents are genuine and correct. In banks, when opening an account you are asked to upload a photo of your passport — this is identity verification. On social networks, the blue checkmark is a sign of account verification. For corporate systems, verification is integrated with access control systems and biometric systems. Learn more about approaches in the technologies section.

Source: term "Verification (authenticity check)"

Verification is required to confirm the authenticity of an identity or data. This is necessary to protect the account from hacking, prevent fraud and fulfill legal requirements (KYC). Banks, exchanges and payment systems are required to check clients to prevent money laundering. For corporate systems, verification is integrated with biometrics and access control systems. The design service will help implement verification in your organization.

Source: term "Verification (authenticity check)"

Verification is a systematic process of checking and confirming that a product, system or process complies with established requirements and specifications. In information security, verification is used to confirm the authenticity of users, documents and data. Biometric systems and CIPF tools are used for highly reliable verification. The Biomark product provides comprehensive solutions for biometric verification. Read more in the technologies section.

Source: term "Verification (authenticity check)"

Completing verification means confirming the validity of your data or identity before a service, payment system or organization. This can be uploading a photo of your passport, confirming a phone number by SMS or a biometric check. In corporate systems, verification is used for access to resources and integration with access control systems. The Biomark and Biovizum products provide biometric verification. Learn more in the technologies section.

Source: term "Verification (authenticity check)"

Synonyms for the word "verification": check, confirmation, attestation, comparison. Depending on the context, the words "authentication", "identification" or "authenticity confirmation" can be used. In technical documentation, the term "conformity check" is often used. The Biomark and Biovizum products are used for biometric verification. Read more about approaches in the technologies section.

Source: term "Verification (authenticity check)"

Phone verification is confirming that the specified mobile phone number really belongs to you. Usually the system sends a temporary code to the number that you need to enter on the website or in the application. This protects against fraudsters and confirms your identity during registration. In corporate systems, phone verification can be integrated with access control systems and biometric systems. The design service will help implement comprehensive verification.

Source: term "Verification (authenticity check)"

Verification is needed to confirm the authenticity of data and protect accounts from fraudsters. It ensures the security of financial transactions, confirms the identity of the user and helps services comply with laws (for example, against money laundering). In corporate systems, verification is integrated with biometrics and access control systems. The Biomark and Biovizum products provide biometric verification. Learn more in the technologies section.

Source: term "Verification (authenticity check)"

Access control is a set of rules, methods and technologies that determine who is allowed to enter physical territory or use information resources. It is divided into physical (ACS) and digital (access to data and systems). It is based on identification, authentication and authorization. The Biomark biometric systems provide reliable identification. The design service will help implement access control.

Source: term "Access control"

Access control systems are divided by architecture: standalone (for one door), networked (managed from a central server) and wireless. By identification method: electronic (cards, key fobs), biometric (fingerprints, face) and mobile (smartphone). Large organizations use the role-based model (RBAC). The Biomark biometric systems provide a high level of security. The design service will help you choose the optimal system.

Source: term "Access control"

An access control system (ACS) is a set of software and hardware tools that automatically determines who is allowed entry. It consists of identifiers (cards, biometrics), readers, controllers (the "brain" of the system) and locking devices (locks, turnstiles). Main functions: entry restriction, working time tracking and security. The Biomark and Biovizum products integrate with ACS. The design service will help implement the system.

Source: term "Access control"

An access controller is the "brain" of an access control system (ACS). It receives a signal from the reader, checks it against the database and decides whether to open the lock or deny access. Controllers are standalone (for one point) and networked (managed centrally). Integration with the Biomark biometric systems increases security. The design service will help you select and configure controllers.

Source: term "Access control"

Access control is important for limiting access to authorized users only, preventing data leaks and protecting critical resources. It ensures compliance with regulator requirements (for example, 152-FZ and 187-FZ) and is the basis of information security. The Biomark biometric systems provide a high level of identification. The design service will help implement effective access control.

Source: term "Access control"

The five principles of access control: deterrence, detection, denial, delay and defense. These principles provide multi-level security: they deter attackers, detect intrusion attempts, block access, delay violators and protect resources. The Biomark biometric systems implement these principles in practice. The design service will help implement a comprehensive system.

Source: term "Access control"

An access control system includes identifiers (cards, key fobs, biometric data), readers (scan the identifier), controllers (make a decision), actuators (locks, turnstiles) and software (rights management, time tracking). Modern ACS integrate with video surveillance and security alarms. The Biomark and Biovizum products provide biometric identification. The design service will help implement a comprehensive ACS.

Source: term "Access control"

Biometrics is a technology in which your unique physical features serve as a "password": a fingerprint, face or voice. The system scans your feature, turns it into a digital code and checks it against what is stored in the database. This is convenient and secure, since it is impossible to forget your biometric data or transfer it to another person. The Biomark and Biovizum products implement various biometric identification methods. Read more in the technologies section.

Source: term "Biometrics (biometric identification)"

Biometrics is identification by unique physical characteristics. The main danger is that, unlike a password, biometric data cannot be replaced if compromised. If a biometric database is hacked, your face or fingerprints will remain compromised forever. Biometric data is protected by 152-FZ. The Biomark and Biovizum products provide a high level of biometric data protection. Learn more about security in the technologies section.

Source: term "Biometrics (biometric identification)"

You can check the presence of biometrics through the Gosuslugi portal or application. Log in, go to the "Profile" section — "Biometrics" tab. If the data has not been submitted, the message "Biometrics is not registered" will be displayed. You can also check in the "Gosuslugi Biometrics" application or on the website of the Unified Biometric System (UBS). There you can also withdraw consent to the use of biometrics. Read more about biometrics in the technologies section.

Source: term "Biometrics (biometric identification)"

Biometrics (collection of face and voice) can be submitted independently through the "Gosuslugi Biometrics" application or in person at an authorized center (for example, at a bank). At the branch, you are photographed with a special camera and asked to speak a random sequence of digits into a microphone to record your voice. The data is sent to the Unified Biometric System (UBS). Submitting biometrics is a voluntary procedure. Our Biomark and Biovizum products are used for corporate biometric systems.

Source: term "Biometrics (biometric identification)"

Biometrics is submitted for remote receipt of services without presenting documents: opening bank accounts, obtaining SIM cards, receiving government services. Biometrics also increases security — unique parameters are harder to forge than a password or plastic card. In Russia, biometrics is used in the Unified Biometric System (UBS). The Biomark and Biovizum products provide biometric identification in corporate systems.

Source: term "Biometrics (biometric identification)"

Biometric data is a convenient and secure way of identification that is harder to forge than a password. On the other hand, if biometric data leaks, it cannot be replaced. Therefore, it is important that biometric systems comply with 152-FZ requirements and use reliable encryption. Our Biomark and Biovizum products ensure secure storage and processing of biometric data. Learn more in the technologies section.

Source: term "Biometrics (biometric identification)"

A person's biometrics includes physiological characteristics: fingerprints, iris pattern, facial features, hand geometry, as well as behavioral characteristics: voice, gait, keyboard typing manner. In Russia, identification by face, voice and fingerprints is most common. The Biomark (fingerprints) and Biovizum (face recognition) products cover the main biometric methods. Read more in the technologies section. For deeper study, we also recommend familiarizing yourself with the biometric template, eSIM and behavioral biometrics.

Source: term "Biometrics (biometric identification)"

AFIS (automated fingerprint identification system) is a software and hardware complex for entering, storing, searching and comparing fingerprints. The systems are used in law enforcement for solving crimes, in the border service for checking entrants and at enterprises for access control. The Biomark product from the Fintech company is a modern AFIS-class solution. Installation services will help implement the system in your organization.

Source: term "AFIS (automated fingerprint identification system)"

In the context of information security and biometrics, AFIS stands for automated fingerprint identification system. In other areas, AFIS can mean an automated dispatch service system (for example, ambulance). In our activities, AFIS is a system for biometric identification by fingerprints. The Biomark product implements all AFIS functions. Read more in the technologies section.

Source: term "AFIS (automated fingerprint identification system)"

In the context of biometrics, AFIS is a complex software and hardware complex. It consists of powerful servers for data storage and processing, high-resolution fingerprint scanners (from 500 dpi) and special software for extracting minutiae and comparing fingerprints. The Biomark product includes all the necessary components for building an AFIS. Installation services will help deploy the system.

Source: term "AFIS (automated fingerprint identification system)"

The Papillon AFIS is one of the most famous Russian automated fingerprint identification systems, developed by the Papillon company. It is used in the Ministry of Internal Affairs of Russia for maintaining fingerprint records. Our Biomark system offers similar functionality for the corporate and public sectors. Installation services will help implement an AFIS in your organization.

Source: term "AFIS (automated fingerprint identification system)"

The Papillon AFIS is a Russian automated fingerprint identification system for registering, processing, comparing and storing biometric data. It identifies not only by fingerprints, but also by face and iris. It is used in the Ministry of Internal Affairs, migration and border services. An alternative solution is the Biomark product from the Fintech company. Installation services will help implement the system.

Source: term "AFIS (automated fingerprint identification system)"

In construction, AFIS is an automated dispatch system for building engineering systems. It is responsible for centralized control of heating, ventilation, water supply and lighting. This is a different class of systems, not related to biometrics. In our activities, AFIS means an automated fingerprint identification system — the Biomark product. Read more about biometric solutions in the technologies section.

Source: term "AFIS (automated fingerprint identification system)"

AFIS processes huge fingerprint databases in seconds, which is practically impossible manually. It provides high identification accuracy, automatic search for matches and reliable data storage. AFIS is used in law enforcement, migration services and access control systems. The Biomark product is a modern AFIS-class solution.

Source: term "AFIS (automated fingerprint identification system)"

You can find out whether your biometric data is registered in the UBS through the Gosuslugi portal. Log in, go to the "Profile" section — "Biometrics" tab. If the data has not been submitted, it will say "Biometrics is not registered". You can also check on the official UBS website by logging in through Gosuslugi. There you can also withdraw consent and delete data. The Biomark and Biovizum products are used for biometric identification.

Source: term "Unified Biometric System (UBS)"

Many large banks are connected to the UBS: Sovcombank, T-Bank, Raiffeisenbank, Bank Finservice and others. The full list of partners is available on the official UBS website. Banks use the UBS for remote client identification when opening accounts and issuing loans. The Biomark and Biovizum products are used for biometric identification in corporate systems. Read more about solutions in the technologies section.

Source: term "Unified Biometric System (UBS)"

The state needs biometrics for remote confirmation of citizens' identity when receiving financial and government services. This allows replacing a personal visit to a bank or government office, speeds up service and increases security. Biometric data is protected in accordance with 152-FZ and stored using certified CIPF tools. The Biomark and Biovizum products provide secure biometric identification.

Source: term "Unified Biometric System (UBS)"

You can check the presence of biometrics in your personal account on the Gosuslugi portal. Log in, click on the profile icon, select the "Profile" tab and go to the "Biometrics" section. There the data status, biometrics type (simplified, standard or confirmed) and validity period will be displayed. You can also check the status through the "Gosuslugi Biometrics" application. The Biomark and Biovizum products provide biometric identification.

Source: term "Unified Biometric System (UBS)"

Biometrics in a bank allows confirming your identity remotely, without presenting a passport. This speeds up opening accounts, issuing loans and other financial services. Banks use the UBS to verify clients' authenticity and protect against fraudsters. For corporate systems, biometric identification is provided by the Biomark and Biovizum products. The design service will help implement biometric identification in your organization.

Source: term "Unified Biometric System (UBS)"

Yes, in Russia you can pay using face biometric identification. Russian banks use face authentication to pay for purchases, preventing the use of photos or masks. Face data is stored in the government biometric system. The function can be disabled in the banking application. The Biomark and Biovizum products are used for biometric identification in corporate systems.

Source: term "Unified Biometric System (UBS)"

A biometric passport contains an electronic chip with the owner's biometric data. The main risks are associated with the possibility of unauthorized data reading in the absence of protection. However, modern passports use encryption and protected protocols. In Russia, biometric data is protected in accordance with 152-FZ. The Biomark and Biovizum products provide secure biometric identification. We also recommend familiarizing yourself with the fingerprinting method.

Source: term "Unified Biometric System (UBS)"

You can recognize a person by face using computer programs (neural networks) that analyze biometric points: the distance between the eyes, nose shape, face contour. Face recognition systems such as Biovizum convert a face into a digital code and compare it with a database. You can also use reverse photo search through services like PimEyes or Search4Faces. The design service will help implement a face recognition system.

Source: term "Face recognition"

Recognition by face is called face recognition. This is a method of biometric contactless identification of a person by their face. Face recognition systems are used for access control, video surveillance and verification. The Biovizum product implements high-precision face recognition algorithms. The design service will help you choose the optimal solution.

Source: term "Face recognition"

You can find a person by face for free using neural network services: Search4Faces (VK and OK databases), PimEyes (global internet search) and Search Face mobile applications. For the best result, use a high-quality photo with clear facial features. In corporate systems, face recognition is implemented in the Biovizum product. The design service will help implement a recognition system.

Source: term "Face recognition"

Face recognition is a way of identifying or confirming a person's identity by the image of their face. Face recognition systems can be used to identify people in real time or in photos and videos. The technology is based on the analysis of biometric points and comparison with reference templates. The Biovizum product implements high-precision face recognition algorithms. The design service will help implement the system.

Source: term "Face recognition"

Face recognition applications are divided into categories: for finding people by photo (PimEyes, Search4Faces), for sorting photos (Tonfotos, Apple Photos) and for security (video surveillance systems with face recognition). In corporate systems, the Biovizum product is used for access control and verification. The design service will help you select and implement a face recognition system.

Source: term "Face recognition"

Yes, modern face recognition systems can identify a person only by the image of their face using neural network algorithms. The systems analyze biometric points and compare with a database. The Biovizum product provides high-precision recognition for access control and verification. The design service will help implement a face recognition system in your organization.

Source: term "Face recognition"

Face recognition works in several stages: detecting a face in an image, analyzing key biometric points (distance between the eyes, nose shape, face contour), converting into a digital code (vector) and comparing with a database. Modern algorithms are based on deep neural networks. The Biovizum product implements these algorithms for security systems. The design service will help implement the system.

Source: term "Face recognition"

Fingerprinting (dactyloscopy) is a method of identifying a person by fingerprints and palms. It is based on the fact that the pattern of papillary lines on the skin is unique for each person and does not change throughout life. The procedure includes scanning or taking fingerprints with special inks. Used in forensics, migration records and access control systems. The Biomark product supports fingerprint identification. Installation services will help implement fingerprint equipment.

Source: term "Fingerprinting (dactyloscopy)"

Fingerprinting is a safe process of scanning or taking fingerprints that lasts a few minutes. In the classic version, printing ink is applied to the fingers and rolled on a form (fingerprint card). In the modern version, fingers are placed on a glass scanner that instantly reads the pattern and sends the data to the database. The procedure is carried out at the Ministry of Internal Affairs or migration centers. The Biomark product supports modern scanning methods.

Source: term "Fingerprinting (dactyloscopy)"

Employees of law enforcement agencies, military personnel, employees of the Ministry of Emergency Situations and customs, as well as foreign citizens for legal stay and work in the Russian Federation are required to undergo fingerprinting. Voluntary fingerprinting can be completed by anyone for personal safety. The Biomark product is used for fingerprint identification in corporate systems. Installation services will help implement the equipment.

Source: term "Fingerprinting (dactyloscopy)"

Foreign citizens can undergo fingerprinting at the territorial department of the Ministry of Internal Affairs (department for migration issues) at their place of stay or at specialized migration centers. In Moscow, the procedure can be completed at the Multifunctional Migration Center. The procedure requires a passport with a notarized translation, a migration card and a document on registration. The Biomark product is used for fingerprint identification.

Source: term "Fingerprinting (dactyloscopy)"

The cost of fingerprinting in the Russian Federation for foreign citizens is from 4,100 rubles. For citizens of the Russian Federation, voluntary fingerprinting is carried out free of charge at territorial departments of the Ministry of Internal Affairs. For obtaining visas and foreign passports, fingerprints are taken when submitting documents at a visa center or consulate. The Biomark product is used for fingerprint identification in corporate systems.

Source: term "Fingerprinting (dactyloscopy)"

The following are subject to mandatory fingerprinting: suspects and accused of committing crimes, convicts, law enforcement officers, military personnel, employees of the Ministry of Emergency Situations and customs, foreign citizens when obtaining a patent or temporary residence permit, as well as all unidentified corpses. The Biomark product is used for fingerprint identification in government and corporate systems. Installation services will help implement the equipment.

Source: term "Fingerprinting (dactyloscopy)"

The fingerprint capture procedure itself takes from 5 to 15 minutes. Issuing a supporting document at the migration center takes 5-10 days. At the Ministry of Internal Affairs, for voluntary submission, a certificate can be issued on the day of application. For obtaining visas, fingerprints are taken directly when submitting documents. The Biomark product provides fast scanning and processing of fingerprint data.

Source: term "Fingerprinting (dactyloscopy)"

TLS is an encryption protocol that creates a secure channel between your browser and a website. Thanks to TLS, data (passwords, card numbers, messages) cannot be intercepted. The padlock icon in the address bar means that TLS is used.

Source: term "TLS (Transport Layer Security)"

SSL is a legacy protocol (1990s), TLS is its modern replacement. SSL contains known vulnerabilities and should not be used. TLS is an evolution of SSL with improved security and speed.

Source: term "TLS (Transport Layer Security)"

TLS 1.3 is the most secure and fastest version. It speeds up the handshake, removes outdated algorithms and provides better protection. It is recommended to use TLS 1.2 at minimum.

Source: term "TLS (Transport Layer Security)"

SSO is when you enter your login and password once and get access to all programs and services at work at once. You don't need to remember ten different passwords — one login works for everything.

Source: term "SSO (Single Sign-On)"

In Russia, SSO is implemented through ESIA (Unified Identification and Authentication System). When you log in to Gosuslugi and then go to an MFC or bank, no re-login is needed — that is SSO. In corporate environments, SSO is used for access to internal systems.

Source: term "SSO (Single Sign-On)"

SSO and MFA solve different tasks. SSO is convenience — one login for all systems. MFA is security — multi-factor authentication (password + SMS + biometrics). SSO can be combined with MFA for convenience and security at the same time.

Source: term "SSO (Single Sign-On)"

Digital security is the protection of your gadgets, accounts and data from hackers and fraudsters. Strong passwords, antivirus, updates — all these are elements of digital security.

Source: term "Digital security"

The main threats: phishing (fake websites and emails), ransomware (file encryption with a ransom), password theft, fake Wi-Fi, social engineering. Protection is passwords, MFA, encryption and vigilance.

Source: term "Digital security"

Install antivirus, enable the firewall, update the system, use unique passwords, enable MFA, don't click suspicious links, create data backups.

Source: term "Digital security"

An antivirus scanner (for example, Dr.Web CureIt!) is a utility for a one-time system check without constant background protection. Full antivirus software is installed as a resident program and works in real time, blocking threats before they launch. In the corporate segment, monitors are also integrated with SIEM systems for centralized collection of security events, which is important for information security monitoring centers (SOC).

Source: term "Antivirus software"

Choosing an antivirus included in the Register of Domestic Software guarantees compliance with legal requirements (152-FZ, 187-FZ) and the absence of the risk of sudden termination of support (as happened with many Western vendors). This is critical for state structures and critical information infrastructure facilities. Within the framework of import substitution, domestic antiviruses provide technical support and database updates even under sanctions restrictions.

Source: term "Antivirus software"

Key signs of infection: sudden slowdown of the system, processor overheating without visible reasons (hidden miner), the appearance of unknown files or the disappearance of documents, as well as disabling of the antivirus software itself or the impossibility of updating it. If you notice this, immediately disconnect the device from the network and run a check with a portable scanner. In corporate networks, such incidents require immediate response and isolation of the segment through network firewalls.

Source: term "Antivirus software"

For weak PCs (1-2 GB RAM) it is better to choose "light" solutions that minimize the load on the processor and disk subsystem. Pay attention to cloud antiviruses — they shift the main analysis load to the provider's servers. It is also worth disabling unused modules (antispam, parental control). Consultation on selecting the optimal configuration can be obtained within the security systems design service.

Source: term "Antivirus software"

Smartphones are also vulnerable to Trojans, spyware and phishing applications. A mobile antivirus scans installed applications, blocks dangerous links in SMS and protects confidential data used to log in to the Fast Payment System (FPS) or confirm operations via the Electronic Signature. Built-in OS tools are often insufficient against sophisticated targeted attacks.

Source: term "Antivirus software"

An antivirus and cryptographic protection tools (CIPF) work in a pair: the antivirus scans files before CIPF begins to encrypt or sign them. If the antivirus detects malicious code during the operation of the crypto gateway, this will prevent the leak of encrypted data. The compatibility of the antivirus with specific CIPF is checked during attestation testing of informatization facilities. For the study of related concepts, we also recommend familiarizing yourself with Antispam filter, SAZ and SDZ.

Source: term "Antivirus software"

In most modern smartphones (Android and iOS), the antispam filter is built into the Phone application. To enable it on Android, go to Settings -> Apps -> Phone -> Caller ID and spam (or a similar section). On iOS: Settings -> Phone -> Silence Unknown Callers. There are also third-party applications (for example, Kaspersky Who Calls, Yandex with Alice, Truecaller) that offer advanced blocking functions. For corporate protection, contact the systems design service.

Source: term "Antispam filter"

To disable the antispam filter on Android, go to Settings -> Apps -> Phone -> Caller ID and spam and deactivate the "Filter spam calls" option. On iPhone, a similar option is located in Settings -> Phone -> Silence Unknown Callers. If you use a third-party application (Yandex with Alice, Kaspersky Who Calls), it needs to be disabled in the settings of the application itself or in the phone settings in the "Call blocking and identification" section.

Source: term "Antispam filter"

Spammers constantly change numbers and bypass black lists, so the filter may let some calls through. It may also depend on the database of your antispam application: if it has not been updated, a new fraudster number may not be recognized. Regularly update your applications and use several levels of protection: for example, a built-in filter + a caller ID from the operator. Fraudsters also use number spoofing, which complicates filtering.

Source: term "Antispam filter"

In email, the antispam filter analyzes incoming letters and sorts them: legitimate letters go to the Inbox, suspicious ones to the Spam folder. Corporate filters can automatically delete letters with viruses or malicious links, and also block letters from senders with a bad reputation. Integration with SIEM makes it possible to log all spam incidents for subsequent analysis and configuration of security rules.

Source: term "Antispam filter"

Yes, this is called a false positive. To avoid this, administrators add trusted senders to whitelists and configure the sensitivity of the filter. If an important letter ends up in spam, the user can mark it as "Not spam" — this retrains the filtering algorithm for future messages. In corporate systems, exceptions are also configured for critical counterparties and government bodies.

Source: term "Antispam filter"

Yes, operator antispam blocks mass automated calls and SMS at the network level, before they reach your phone. It is especially relevant for protection against 'probing' calls and fraudsters posing as banks or government bodies. This service is often provided free of charge and is deactivated at the subscriber's request. In Russia, operators actively use antispam systems within the framework of the requirements of Federal Law 38 'On Communications'.

Source: term "Antispam filter"

Antispam filters block phishing letters that try to extort passwords, bank card data or confidential information from employees. Modern antispam solutions use ML algorithms to analyze suspicious links, imitation domains and non-standard sender addresses. In conjunction with DLP systems, antispam also controls outgoing messages, preventing data leaks through mail channels.

Source: term "Antispam filter"

The main difference: VPN encrypts all traffic at the operating system level, creating a secure tunnel, and provides full confidentiality. A proxy server works only with specific applications (for example, a browser) and does not encrypt data — it only substitutes the IP address. VPN protects against traffic interception by the provider, a proxy only hides the IP. For corporate protection, a combination of a proxy and a firewall is often used.

Source: term "Proxy server"

Proxy servers can be obtained in three ways: free public (unstable, slow, unsafe — they can intercept data), paid private (stable, fast, suitable for business and personal use) and your own server (maximum security and control, deployed on VPS or in the company's infrastructure).

Source: term "Proxy server"

Free proxies are often overloaded, slow and unstable. The main risk is that they can intercept your traffic: logins, passwords, card data (especially on HTTP sites). Also, the owners of free proxies can sell your metadata to advertisers, inject malicious advertising or use your resources for attacks. For working with the digital ruble and FPS, the use of public proxies is unacceptable.

Source: term "Proxy server"

Proxy configuration in Windows is done in the Settings -> Network and Internet -> Proxy section. Enable the "Use a proxy server" option, enter the IP address and port of the proxy. An alternative method is configuration in the browser through extensions (for example, FoxyProxy) or in the browser's network settings. For corporate networks, configuration is often done centrally through Group Policy (GPO).

Source: term "Proxy server"

Private proxies with SOCKS5 and HTTPS protocols located on Russian servers or servers in friendly countries work stably in Russia. It is important to choose servers that do not violate the legislation of the Russian Federation and use them in accordance with 187-FZ for corporate purposes. For government systems, only certified proxy solutions from the Register of Domestic Software are used.

Source: term "Proxy server"

In a corporate network, a proxy server is used for: filtering and caching web traffic (speeding up loading), organizing access control to external resources within security policies (blocking unwanted sites), load balancing between servers (Reverse Proxy), ensuring anonymity when working with external services, auditing user actions (request logging) and protection from malicious sites through integration with antivirus software.

Source: term "Proxy server"

Yes, proxy servers are often used to bypass geographic blocks and access restrictions to foreign sites. However, it is important to remember that using a proxy to bypass legislative restrictions may violate Russian legislation (in particular, the requirements for storing data on the territory of the Russian Federation). For legal use of a proxy for corporate purposes, it is recommended to use servers located in Russia and comply with the requirements of 187-FZ and 152-FZ.

Source: term "Proxy server"

An ordinary firewall works at the network and transport levels (L3-L4), analyzing IP addresses, ports and protocols. A WAF works at the application level (L7) and analyzes the contents of HTTP requests: parameters, headers, request body. For example, a firewall will let an SQL injection through if it comes on an allowed port 443 (HTTPS), while a WAF will block it, seeing malicious code in the request parameters.

Source: term "WAF (Web Application Firewall)"

Both own developments and localized solutions are presented in Russia. Popular domestic WAFs include PT Application Firewall (Positive Technologies), Webmonitorx ProWAF, SolidWall WAF and UserGate WAF. Most of them are included in the Register of Domestic Software and have FSTEC certificates, which makes them mandatory for use in state information systems and at CII facilities.

Source: term "WAF (Web Application Firewall)"

A WAF protects against L7 DDoS attacks (at the application level) that imitate the behavior of real users (for example, mass GET requests to heavy pages or POST requests with large amounts of data). Unlike network DDoS protections, a WAF analyzes behavioral patterns: the frequency of requests from one IP, User-Agent, cookies and timings. Cloud WAFs also integrate with CDN for load distribution and traffic filtering at the network edge.

Source: term "WAF (Web Application Firewall)"

A WAF can be both cloud (SaaS) and local (on-premise). Cloud WAF does not require equipment installation, is easily scaled, updated centrally and is suitable for small and medium-sized businesses. Local WAF is installed in the company's infrastructure and provides full control over data, which is critical for government structures and CII facilities. The choice of variant is discussed at the stage of security system design.

Source: term "WAF (Web Application Firewall)"

A WAF generates event logs (blocks, warnings, anomalies) that are transferred to the SIEM system via syslog, SNMP or API protocols. In SIEM, WAF logs are correlated with data from other protection tools (firewalls, antiviruses, DLP, EDR) to detect complex attacks and restore the attack chain. This allows the information security monitoring center (SOC) to promptly respond to incidents and conduct investigations.

Source: term "WAF (Web Application Firewall)"

Configuring a WAF requires professional knowledge in the field of web application security, since incorrect configuration can lead to false blocks of legitimate traffic (false positives) or, on the contrary, to missing attacks. Modern WAFs support a learning mode in which the system analyzes typical traffic and automatically forms rules. For complex projects, it is recommended to involve specialists — the design service and training courses help avoid typical errors.

Source: term "WAF (Web Application Firewall)"

A WAF does not protect against all types of threats. It cannot prevent network-level attacks (for example, L3/L4 DDoS), vulnerabilities in server software, insider threats (employee actions) and physical data theft. Also, a WAF cannot protect against attacks using legitimate requests (for example, business logic attacks). Therefore, a WAF should be used in combination with other protection tools: firewalls, EDR/XDR, antiviruses and monitoring systems.

Source: term "WAF (Web Application Firewall)"

IDS only detects attacks and notifies the administrator, but does not block traffic. It is a passive monitoring tool. IPS actively intervenes: resets connections, blocks IP addresses and prevents the spread of threats in real time. IPS is an evolution of IDS, providing proactive protection. Both systems are often integrated with SIEM for centralized management and event analysis.

Source: term "IPS (Intrusion Prevention System)"

An IPS uses behavioral analysis and machine learning to detect zero-day attacks. The system builds a baseline profile of normal traffic and detects anomalies (for example, non-standard packet sequences, unusual request sizes, data uncharacteristic of a given protocol). Modern IPSs also use reputation analysis and Threat Intelligence to detect new attack patterns without the need for signatures.

Source: term "IPS (Intrusion Prevention System)"

Yes, an IPS and antivirus complement each other, creating layered protection. The antivirus protects at the file system level, analyzing files and processes on end devices. An IPS protects at the network level, blocking malicious traffic before it reaches the device. Together they cover different attack vectors and provide comprehensive protection.

Source: term "IPS (Intrusion Prevention System)"

The Russian market offers IPS solutions from domestic vendors: UserGate, PT Network Security (Positive Technologies), Kaspersky, Continent IPS (Kod Bezopasnosti). Most of them are included in the Register of Domestic Software and certified by FSTEC, which makes it possible to use them in government systems and at CII facilities.

Source: term "IPS (Intrusion Prevention System)"

It is recommended to use a combined approach: at the network edge (in front of the data center) for protection from external attacks, and inside segments (between departments, between server zones) for controlling internal traffic and preventing lateral movement of attackers. This creates layered protection (defense in depth). The correct architecture is developed within the security systems design service.

Source: term "IPS (Intrusion Prevention System)"

Modern IPS solutions operate in inline mode (all traffic passes through them) and can create additional delays of up to 1-2 ms, which is usually imperceptible to users. Performance depends on the power of the equipment (processor, memory) and the volume of analyzed traffic. For high-load networks, hardware IPS accelerators or a distributed architecture with load balancing are recommended, which is discussed at the design stage.

Source: term "IPS (Intrusion Prevention System)"

An IPS saves detailed logs of all events: blocked packets, attacker IP addresses, attack types, timestamps, as well as full or partial traffic dumps (when configured). These data are transferred to SIEM and stored in data storage systems (DSS) for forensic analysis. When investigating an incident, analysts can reconstruct the chronology of the attack, identify penetration vectors and understand which systems were at risk.

Source: term "IPS (Intrusion Prevention System)"

EDR (Endpoint Detection and Response) protects specific end devices (PCs, servers), analyzing activity at the OS level. NDR protects the network as a whole, analyzing traffic between devices. They complement each other: NDR sees the movement of attackers between devices, and EDR — what exactly happens on the infected host. Together they provide full-fledged protection, especially when integrated with SIEM.

Source: term "NDR (Network Detection and Response)"

Both own developments and localized solutions are presented in Russia. Popular domestic NDRs include Kaspersky NDR, Positive Technologies NDR (PT Network Attack Discovery) and Garda NDR. Most of them support work with CII facilities and can integrate with other protection tools within the framework of import substitution.

Source: term "NDR (Network Detection and Response)"

Modern NDR systems analyze metadata of encrypted traffic: packet sizes, time intervals, connection directions, request frequency, TLS certificates (in the unencrypted part). This makes it possible to detect anomalies even without decryption. Deep analysis of HTTPS content requires integration with DPI (Deep Packet Inspection) or TLS inspection systems, which is discussed at the design stage.

Source: term "NDR (Network Detection and Response)"

NDR saves the full history of network interactions (metadata, flows, logs) in data storage systems. When an incident is detected, analysts can reconstruct the time line of the attack: from the first contact (implantation) to the moment of detection and the attacker's actions (C2, movement, exfiltration). This is critically important for information security monitoring centers (SOC) when conducting forensics.

Source: term "NDR (Network Detection and Response)"

NDR collects network traffic metadata: source and destination IP addresses, ports, protocols, packet sizes, timestamps, number of connections, volume of transferred data, session duration. It is important that NDR does not intercept the contents of user traffic (files, messages, e-mail contents), which complies with legal requirements, including the protection of electronic signatures and personal data.

Source: term "NDR (Network Detection and Response)"

The implementation of NDR requires configuring network equipment (SPAN ports on switches, TAP aggregators for physical traffic interception) and integration with existing security systems (SIEM, SOAR, Firewall). For large distributed networks, several sensors may need to be installed in different segments. Professional design makes it possible to minimize the impact on network performance and ensure correct operation of the system.

Source: term "NDR (Network Detection and Response)"

For CII facilities, NDR solutions must be certified by FSTEC of Russia, included in the Register of Domestic Software, support work with Russian operating systems (Astra Linux, RED OS) and integrate with state monitoring systems (GosSOPKA). Compliance with information protection requirements established by FSTEC orders is also required.

Source: term "NDR (Network Detection and Response)"

An ordinary antivirus uses signature analysis and protects against known threats for which signatures have already been created. EDR uses behavioral analysis and machine learning to detect unknown attacks (zero-day), APT threats and fileless attacks. EDR also provides tools for incident investigation (forensics) and automatic response (isolation, process blocking), while an antivirus simply blocks or removes a malicious file.

Source: term "EDR (Endpoint Detection and Response)"

EDR collects extensive telemetry from endpoint devices: running and terminated processes, network connections (outgoing and incoming), changes in the system registry, file operations (creation, modification, deletion), user activity (logins, application launching), loading of drivers and kernel modules. These data are transferred to the central console for analysis and can be stored in data storage systems for subsequent incident investigation.

Source: term "EDR (Endpoint Detection and Response)"

The Russian market offers EDR solutions from leading domestic vendors: Kaspersky EDR, PT EDR (Positive Technologies), Garda EDR, Solar Dozor (Solar Security). Most of them are included in the Register of Domestic Software and certified by FSTEC, which makes it possible to use them in government systems and at CII facilities.

Source: term "EDR (Endpoint Detection and Response)"

EDR saves the full history of events on endpoint devices over a long period. When an incident is detected, analysts can reconstruct the entire chronology of the attack: how the malicious code got onto the device (the attack vector), which processes it launched, which files it created or modified, which network connections it established, which accounts it used. This is critically important for information security monitoring centers (SOC) during forensic analysis.

Source: term "EDR (Endpoint Detection and Response)"

Modern EDR agents use lightweight drivers and are optimized for minimal impact on performance. On average, the load on the processor is 1-3%, which is imperceptible to the user. However, for weak PCs, it is recommended to use resource saving modes and configure the frequency of data collection. The choice of the correct configuration is discussed at the stage of security system design.

Source: term "EDR (Endpoint Detection and Response)"

The implementation of EDR requires installing agents on all endpoint devices (PCs, servers, laptops, including remote ones) and configuring a central management console. For large organizations with a distributed infrastructure, several management servers may need to be deployed and network policies configured. Professional design and staff training on training courses will help avoid typical errors.

Source: term "EDR (Endpoint Detection and Response)"

EDR protects against ransomware in several ways. First, behavioral analysis detects suspicious activity characteristic of extortionists: mass file encryption, changing extensions, attempts to delete shadow copies (VSS). Second, when such activity is detected, EDR can automatically isolate the device from the network, block the malicious process and start recovery from backups. Third, EDR helps investigate the attack and understand how the attacker entered the system to prevent repeated attacks.

Source: term "EDR (Endpoint Detection and Response)"

EDR protects only endpoint devices (PCs, servers), analyzing activity at the OS level. XDR protects the entire infrastructure: devices, network, cloud, e-mail, identity systems. XDR is an evolution of EDR that provides end-to-end threat detection and automatic correlation of events from different sources. You can learn more in the article about EDR.

Source: term "XDR (Extended Detection and Response)"

SIEM collects and correlates logs from the entire infrastructure, but requires manual configuration of rules and often generates many false positives. XDR automates the correlation process, uses ML to reduce noise and offers built-in response scenarios. XDR also integrates more deeply with protection tools for automatic threat blocking without human participation.

Source: term "XDR (Extended Detection and Response)"

The Russian market offers XDR solutions from domestic vendors: Kaspersky XDR, Positive Technologies XDR (based on PT Ecosystem), Solar XDR (from the company RTC-Solar). Most of them support integration with Russian OS (Astra Linux, RED OS) and cloud platforms, and are also included in the Register of Domestic Software, which makes it possible to use them in government systems and at CII facilities.

Source: term "XDR (Extended Detection and Response)"

XDR automatically links events from different sources (EDR, NDR, e-mail, cloud) into a single attack timeline. An analyst can see the whole picture: from the moment of penetration (for example, a phishing e-mail) to the final impact (for example, data encryption). This is critically important for information security monitoring centers (SOC), where the speed of investigation directly affects the minimization of damage.

Source: term "XDR (Extended Detection and Response)"

XDR does not completely replace SIEM, but complements it. SIEM is better for compliance with regulatory requirements (for example, storing logs for 3 years for CII), and XDR is for operational detection and response. The optimal strategy is to use them together: SIEM for collection and long-term storage, XDR for automated analysis and real-time response.

Source: term "XDR (Extended Detection and Response)"

The implementation of XDR is more complex than EDR, since it requires integration with a large number of data sources: EDR, NDR, mail gateways, cloud platforms, access control systems. For large organizations, several months may be needed for deployment and configuration of correlations. Professional design and staff training on training courses are key success factors.

Source: term "XDR (Extended Detection and Response)"

For CII facilities, XDR solutions must be certified by FSTEC of Russia, included in the Register of Domestic Software, support work with Russian operating systems and GOST cryptographic algorithms, and also ensure integration with state monitoring systems (GosSOPKA). Special attention is paid to data protection and logging of all security events.

Source: term "XDR (Extended Detection and Response)"

SIEM collects logs and detects threats. SOAR takes detected incidents and automatically responds to them. Roughly speaking, SIEM says "something went wrong", and SOAR — "block the IP, isolate the device, disable the account". SIEM and SOAR complement each other: SIEM for detection, SOAR for response.

Source: term "SOAR (Security Orchestration, Automation and Response)"

A playbook is a pre-written scenario of automatic response to an incident. For example, a playbook for a phishing e-mail may include: extracting attachments, checking hashes against threat databases, blocking the sender, notifying the employee. Playbooks are developed by SOC analysts and continuously improved on the basis of experience.

Source: term "SOAR (Security Orchestration, Automation and Response)"

The Russian market offers SOAR solutions from domestic vendors: R-Vision SOAR, Security Vision SOAR, UDV SOAR. Most of them are included in the Register of Domestic Software and certified by FSTEC, which makes it possible to use them in government systems and at CII facilities.

Source: term "SOAR (Security Orchestration, Automation and Response)"

SOAR automates the routine tasks of information security monitoring center (SOC) analysts: collecting context information, blocking IP addresses, isolating devices. This frees up time for complex investigations and reduces the response time to threats. SOAR also provides a unified console for managing all incidents and controlling SLA.

Source: term "SOAR (Security Orchestration, Automation and Response)"

SOAR does not replace analysts, but makes their work more effective. Complex, non-standard incidents require human analysis and decision-making. SOAR automates only routine, repetitive tasks, allowing analysts to focus on strategic aspects of security. Analysts also develop and maintain playbooks.

Source: term "SOAR (Security Orchestration, Automation and Response)"

The implementation of SOAR requires integration with dozens of different protection tools: SIEM, EDR, firewalls, DLP, antiviruses. It is also necessary to develop and test playbooks for typical incidents. Professional design and staff training on training courses are key success factors.

Source: term "SOAR (Security Orchestration, Automation and Response)"

The implementation of SOAR makes it possible to significantly improve key SOC metrics: MTTD (Mean Time to Detect) — reduces threat detection time through automatic correlation and data enrichment; MTTR (Mean Time to Respond) — reduces response time from hours to minutes through automatic playbooks; reduces the number of false positives and increases analyst productivity by 3-5 times.

Source: term "SOAR (Security Orchestration, Automation and Response)"

Classic systems (firewalls, antiviruses) work according to known signatures and rules — they know what to look for. UEBA works on the basis of behavioral analysis, detecting deviations from normal behavior. This makes it possible to detect attacks that do not have known signatures (for example, zero-day, APT, insider threats), which classic systems will simply miss.

Source: term "UEBA (User and Entity Behavior Analytics)"

A baseline is a model of typical activity of a user or device, built by ML algorithms on the basis of historical data over 3-6 months. The profile includes: typical login and logout time, used applications, volume of transferred data, geolocation, frequency of actions, typical work patterns. Any deviation from the profile is considered an anomaly and assessed on a risk scale.

Source: term "UEBA (User and Entity Behavior Analytics)"

Yes, UEBA effectively detects insider threats (malicious or careless actions of employees). For example, if an employee starts downloading an anomalously large amount of data, connects external devices, works at uncharacteristic times, tries to bypass control systems or sends data to a personal e-mail — UEBA marks these actions as suspicious. It is important to configure profiles and thresholds correctly to reduce false positives.

Source: term "UEBA (User and Entity Behavior Analytics)"

UEBA analyzes data from many sources: application logs (Active Directory, ERP, CRM), network traffic (via NDR), activity in corporate systems, data from EDR/XDR, authentication logs (successful and failed logins), data from DLP systems (file transfer, printing), as well as data from SIEM systems. The more data sources, the more accurate the profiles.

Source: term "UEBA (User and Entity Behavior Analytics)"

On the Russian market, UEBA is often part of comprehensive solutions: Solar Dozor, MaxPatrol SIEM (Positive Technologies) with a UEBA module, Kaspersky UEBA, Garda UEBA. Many solutions integrate with Russian cryptographic protection systems, support work with Russian OS and are included in the Register of Domestic Software.

Source: term "UEBA (User and Entity Behavior Analytics)"

The implementation of UEBA requires collecting and processing large volumes of data from various sources, which can take 3-6 months. It is necessary to correctly configure ML algorithms, determine thresholds for each profile and integrate UEBA with existing systems (SIEM, DLP, EDR). It is also important to train SOC analysts to work with the system.

Source: term "UEBA (User and Entity Behavior Analytics)"

UEBA helps organizations comply with the requirements of 152-FZ (protection of personal data) and 187-FZ (CII protection), detecting unauthorized access to data and suspicious user actions. When anomalies are detected, the system generates an alert, allowing a prompt response to threats and prevention of leaks.

Source: term "UEBA (User and Entity Behavior Analytics)"

UA (unauthorized access) is when someone gains access to your data or system without permission. For example, a hacker guesses a password, an employee looks into other people's files, or an attacker penetrates the server room. Cryptographic protection tools, passwords and access control systems are used for protection.

Source: term "Unauthorized access (UA)"

The main laws: 152-FZ "On Personal Data" (protection of personal information), 187-FZ "On CII Security" (protection of critical infrastructure) and FSTEC orders that establish requirements for protection tools against UA for government systems.

Source: term "Unauthorized access (UA)"

PT against UA is information protection tools against unauthorized access. This is a complex of software, hardware and software-hardware solutions that prevent attempts to penetrate, steal or modify data. They include CIPF, authentication systems, firewalls and access control systems.

Source: term "Unauthorized access (UA)"

UA attempts are detected using SIEM systems that analyze logs and security events, intrusion detection systems (IDS/IPS), as well as DLP systems that track suspicious user actions. Regular audit of access journals also helps to notice anomalies in time.

Source: term "Unauthorized access (UA)"

When UA is detected, it is necessary to immediately: isolate the infected network segment, block compromised accounts, record all traces for investigation and notify the information security monitoring center (SOC). After the incident, a forensic analysis must be carried out and security policies updated.

Source: term "Unauthorized access (UA)"

The main UA channels: unpatched vulnerabilities in web applications and servers, weak passwords on administrative interfaces, infected removable media, phishing attacks through e-mail and messengers, as well as zero-day (0-day) vulnerabilities. It is important to conduct regular vulnerability scans and pentests.

Source: term "Unauthorized access (UA)"

For CII facilities, the use of certified protection tools from the register of domestic software is required, mandatory categorization of facilities, notification of FSTEC about incidents and regular attestation testing. The use of foreign software at CII facilities is also prohibited.

Source: term "Unauthorized access (UA)"

An ordinary antivirus may not have FSTEC certification. APT is a certified tool that meets the strict requirements of regulators and can be used in government systems and at CII facilities. APT also has extended audit and integration functions.

Source: term "Antivirus protection tool (APT)"

APT for government systems must be included in the Register of Domestic Software, have an FSTEC or FSB certificate, ensure the integrity of its own code and logs, and have centralized management and SIEM integration functions.

Source: term "Antivirus protection tool (APT)"

No, APT and CIPF are different classes of protection tools. APT protects against malware, and CIPF provides cryptographic data protection (encryption, electronic signature). They work in tandem, creating comprehensive information system protection.

Source: term "Antivirus protection tool (APT)"

The choice of APT depends on the requirements of regulators (FSTEC, FSB), the type of the protected system (government, commercial, CII), the number of users and the infrastructure architecture. Advice on selection can be obtained within the security systems design service.

Source: term "Antivirus protection tool (APT)"

The Russian market offers certified solutions: Kaspersky Anti-Virus (certified version), Dr.Web (certified version), Kaspersky Endpoint Security. Most of them are included in the Register of Domestic Software and have FSTEC certificates.

Source: term "Antivirus protection tool (APT)"

APT should be updated daily to ensure the relevance of antivirus databases. Critical security updates should be installed immediately after their release. In government systems, updates must be carried out in accordance with approved regulations.

Source: term "Antivirus protection tool (APT)"

No, for government systems and CII facilities, the use of free antiviruses is not allowed. The use of certified APTs included in the Register of Domestic Software and having FSTEC or FSB certificates is required. Free antiviruses do not provide the necessary level of protection.

Source: term "Antivirus protection tool (APT)"

A trusted boot tool (TBT) protects the system from attacks at the early boot stage, when the OS has not yet been launched and antiviruses are not working. This makes it possible to prevent the injection of bootkits and rootkits that can intercept system control before the start of protection.

Source: term "Trusted boot tool (TBT)"

The Russian market offers certified solutions: Dallas Lock, Sobol, ViPNet SafeBoot, Accord-HTBM. Most of them meet the requirements of 187-FZ and can be used at CII facilities.

Source: term "Trusted boot tool (TBT)"

Secure Boot is a built-in UEFI mechanism that checks the digital signatures of loaders. TBT is a more comprehensive solution that can include hardware tokens, biometric authentication and extended integrity checking mechanisms not available in standard Secure Boot.

Source: term "Trusted boot tool (TBT)"

TBT can be both software (integrated into UEFI or the boot record) and hardware (physical expansion cards, USB tokens). For CII facilities, hardware modules that provide the maximum level of protection from physical intervention are often used.

Source: term "Trusted boot tool (TBT)"

TBT integrates with ACS for centralized access management, with CIPF for ensuring the integrity of cryptographic keys and with SIEM for transferring trusted boot event logs.

Source: term "Trusted boot tool (TBT)"

HTBM is a specialized hardware device installed on the motherboard that performs system integrity checking before the BIOS/UEFI starts. HTBM is considered the most reliable type of TBT, since it is physically separated from the main system and cannot be compromised by software attacks.

Source: term "Trusted boot tool (TBT)"

For commercial organizations, the use of TBT is not mandatory, unless they work with personal data or are CII facilities. However, for banks, insurance companies and other organizations working with confidential information, the use of TBT is recommended as a security best practice.

Source: term "Trusted boot tool (TBT)"

RMCT prevents the leak of confidential data through USB flash drives and external disks, blocks system infection through infected media and makes it possible to track employee actions with external devices. This is a mandatory requirement for systems working with personal data and at CII facilities.

Source: term "Removable media control tool (RMCT)"

RMCT performs the functions of access control to media, control of their connection, automatic encryption of data on removable devices, audit of all operations and antivirus check of connected media together with antivirus software.

Source: term "Removable media control tool (RMCT)"

RMCT is often a module of DLP systems, providing control at the level of connected devices. DLP receives from RMCT data about all operations with external media and can apply security policies, for example, block the writing of certain file types or encrypt all data.

Source: term "Removable media control tool (RMCT)"

In Russia, RMCT is often part of comprehensive solutions: Secret Net Studio, Dallas Lock, Solar Dozor. Most of them are certified by FSTEC and included in the Register of Domestic Software.

Source: term "Removable media control tool (RMCT)"

RMCT uses several levels of protection: control at the OS level, hardware identification of devices, encryption and audit. To bypass RMCT, it is necessary to have administrative rights or use specialized methods that can also be detected by the system. Regular updates and audits help minimize bypass risks.

Source: term "Removable media control tool (RMCT)"

Modern RMCTs use optimized algorithms and practically do not affect system performance. The impact on the speed of operation is less than 1-2% even with active use of external media.

Source: term "Removable media control tool (RMCT)"

For small business, the use of RMCT is not mandatory, unless the company works with personal data or is a CII facility. However, to protect trade secrets and prevent leaks, it is recommended to use RMCT as part of a comprehensive security system.

Source: term "Removable media control tool (RMCT)"

Recommended for all organizations working with digital data, especially processing personal data or related to CII. Legally not mandatory, but often required for government contracts.

Source: term "Cyber insurance"

Personal data leaks, ransom payments, legal expenses, IT system recovery, loss of profit and PR services.

Source: term "Cyber insurance"

Antivirus software, backup systems, security policies, SIEM systems, incident response plans and staff training.

Source: term "Cyber insurance"

From 50,000 to 200,000 rubles per year for small business, 200,000 to 1 million for medium, from 1 million for large enterprises.

Source: term "Cyber insurance"

Choose a company, undergo a cybersecurity audit, provide documents, sign a contract. In an insured event notify the insurer within 24-48 hours.

Source: term "Cyber insurance"

Yes, if minimum security requirements were not met, the insurer was not notified on time, or the incident occurred due to insiders.

Source: term "Cyber insurance"

Yes, most policies cover ransom payments and system recovery. Insurers require quality backup to minimize the need for payment.

Source: term "Cyber insurance"

PCI DSS is an international set of security rules for companies that accept payment by bank cards. These rules protect customer data from theft and fraud. If your business accepts cards, you are obliged to comply with PCI DSS. Read about payment security in the article Fintech.

Source: term "PCI DSS"

PCI DSS is needed by all organizations that accept, transmit or store payment card data. These are banks, online stores, payment systems, delivery services, hotels, restaurants — any business that works with cards. Even if you have a small online store, you are obliged to comply with PCI DSS.

Source: term "PCI DSS"

12 requirements cover six areas: network protection (firewalls, changing passwords), protection of card data (encryption), vulnerability management (antiviruses, updates), access control (authentication, restriction of rights), monitoring and testing, information security policies. The full list of requirements is in the article Cloud security.

Source: term "PCI DSS"

The PCI DSS certificate is valid for 12 months. After 10 months, you need to start the renewal procedure — undergo a repeated audit or fill out a new self-assessment questionnaire and conduct a quarterly network scan. The certificate must be renewed every year.

Source: term "PCI DSS"

Non-compliance with PCI DSS entails serious consequences: fines from payment systems (up to $100,000 per month), suspension of payment acceptance, lawsuits from affected customers and reputational losses. In some cases — revocation of the payment acceptance license. Read about security risks in the article Fraud.

Source: term "PCI DSS"

To prepare for the audit, it is necessary: to conduct an internal security review (you can order certification testing), implement encryption of card data, set up firewalls and a monitoring system, train employees in security rules, prepare documentation on security policies. It is recommended to involve a qualified specialist (QSA).

Source: term "PCI DSS"

PCI DSS is a specialized security standard for payment data. ISO 27001 is a general information security management standard that is suitable for any data. PCI DSS is mandatory for companies that accept cards. ISO 27001 is voluntary, but is often required for large clients and tenders. They can complement each other.

Source: term "PCI DSS"

OAuth is a way to log into a website without creating a new login and password. You press “Sign in with Google” or “Sign in with VKontakte”, give permission, and the site gets access only to what you allowed (for example, your name and email). Your password is never transferred to the site. It is like a digital pass with limited rights instead of handing over the keys to the whole apartment. Read about data security in the article Information security.

Source: term "OAuth"

OAuth 2.0 works on the principle of a “digital pass”: you give permission to a service (for example, Google), and it issues a temporary key (token) to the application to access your data. The application does not know your password and cannot get access to what you did not allow. The process involves four parties: the resource owner (you), the client (application), the authorization server (Google) and the resource server (API). The token is valid for a limited time and can be revoked at any moment. Read about how tokens work in the article Security token.

Source: term "OAuth"

OAuth 2.0 is a modern version of the protocol. It is simpler to use for developers (does not require complex request signing), supports more scenarios (mobile applications, smart devices, server-to-server) and uses refresh tokens to extend access without re-entering. OAuth 2.0 also relies more on HTTPS for security. Today OAuth 2.0 is used everywhere, while OAuth 1.0 is considered outdated.

Source: term "OAuth"

OAuth is safer than transferring a password. If the application turns out to be fraudulent, with OAuth you give it access only to limited data (for example, only to your name), not to the entire account. You can revoke access at any moment in your account settings. When transferring a password, you risk the entire account — an attacker can get access to all your data, including email, documents and payment information. Read about account protection in the article Verification.

Source: term "OAuth"

OAuth is considered safe when used correctly. Tokens are transmitted over a secure channel (HTTPS), have a limited validity period and a limited scope of rights. However, there are risks: token interception (MITM attack), phishing (a fake login page), CSRF attacks and client secret compromise. To protect yourself, use HTTPS, short token lifetimes, the state parameter to protect against CSRF and PKCE for mobile applications.

Source: term "OAuth"

OAuth is used in almost all modern web and mobile applications. The buttons “Sign in with Google”, “Sign in with Facebook”, “Sign in with Yandex”, “Sign in with VKontakte” are OAuth. OAuth is also used in APIs for exchanging data between services (for example, CRM integration with email services), in corporate systems for single sign-on (SSO) and in IoT devices. It is used by Google, Facebook, GitHub, Microsoft, Yandex, VKontakte and thousands of other services. Read about setting up APIs in the article Infrastructure.

Source: term "OAuth"

OAuth is an authorization protocol (what is allowed to be done with your data), while SSO (Single Sign-On) is a solution for authentication (who you are). SSO allows you to log into a system once and get access to all applications without re-entering a password. OAuth can be used as part of an SSO solution, but these are different concepts. SSO is often built on SAML or OpenID Connect protocols (which uses OAuth 2.0 for authentication). OAuth gives access to data, SSO simplifies login to several systems.

Source: term "OAuth"

CAPTCHA is a test that checks that you are a human, not a bot. Websites use CAPTCHA to protect against spam, fake activity and automatic attacks. You may be asked to enter distorted letters, select pictures with certain objects or simply tick the “I am not a robot” box. Read about website protection in the article Information security.

Source: term "CAPTCHA"

The main types: text (entering distorted characters), interactive (the “I am not a robot” box plus selecting pictures), audio (listening and entering digits), invisible (works in the background) and slider CAPTCHA (assembling a puzzle or moving the slider). The most popular type is reCAPTCHA from Google. Read about protection technologies in the article Antivirus software.

Source: term "CAPTCHA"

CAPTCHA protects websites from bots and automatic programs. Without CAPTCHA, attackers could create millions of fake accounts, leave spam in comments, buy up all the tickets to events or hack accounts by brute-forcing passwords. CAPTCHA also protects servers from excessive load.

Source: term "CAPTCHA"

The reasons can be different: you have a VPN or proxy on, an ad blocker (AdBlock) is active, JavaScript is disabled, cookies are turned off or you send requests too quickly. Try disabling the VPN and blockers, clearing the browser cache and reloading the page. Read about browser settings in the article Incognito mode.

Source: term "CAPTCHA"

Technically yes, there are CAPTCHA solving services that use real people or neural networks. However, using such services violates the rules of many websites and can lead to a block, and in some cases to liability under Art. 272 of the Criminal Code of the Russian Federation (illegal access to computer information). For ordinary users, the best way is to correctly pass the CAPTCHA with clean browser settings.

Source: term "CAPTCHA"

Yes, reCAPTCHA from Google is a legitimate and safe service. However, in Russia using reCAPTCHA is complicated — the service may not load due to blocks or send data to foreign servers, which violates the 152-FZ on data localization. Russian websites are increasingly switching to domestic analogues (Yandex SmartCaptcha).

Source: term "CAPTCHA"

Invisible CAPTCHA works in the background, requiring no action from the user. The system analyzes user behavior: mouse movements, typing speed, browser history, time on the page. If the behavior looks “human”, the verification passes unnoticed. If there are suspicions, a standard task appears. Read about protection from tracking in the article Digital footprint.

Source: term "CAPTCHA"

Incognito mode is a browser private mode that does not save history, cookies and entered data after closing the window. It is like a one-time session — after closing the window no traces remain. But remember: the provider and websites still see your activity. Read about data protection in the article Digital footprint.

Source: term "Incognito mode"

The fastest way is to press Ctrl+Shift+N on a computer (Windows) or Cmd+Shift+N (Mac). On a phone, open the browser, press the three dots (Chrome) or the tabs icon (Safari) and select “New incognito tab” or “Private Browsing”. Read about browser settings in the article Infrastructure.

Source: term "Incognito mode"

Incognito hides history only from other users of your device. Your internet provider, the network owner (work, cafe) and the websites you visit still see your activity. They see your IP address and which websites you open. For complete anonymity, use a VPN. Read about protection from surveillance in the article Information security.

Source: term "Incognito mode"

No, history in incognito mode is not saved on the device. After closing the window, all data (history, cookies, cache) is deleted. However, your provider and websites can save logs of your activity. Also, bookmarks and downloaded files will remain on the device.

Source: term "Incognito mode"

Incognito hides history only on your device — from other users of the same computer. A VPN hides your activity from the provider and everyone on the network, encrypts traffic and changes the IP address. Incognito is for local privacy, VPN is for complete anonymity on the internet. Read about VPN in the article VPN.

Source: term "Incognito mode"

Yes, incognito mode does not protect from viruses. It hides history, but does not block malicious files and phishing sites. If you download a virus or follow a dangerous link, the device will be infected even in incognito. Use an antivirus and be careful on the internet. Read about protection from viruses in the article Antivirus software.

Source: term "Incognito mode"

Incognito is a browser feature that works only on your device. When you visit a website, your computer still sends a request over the internet — and both the provider and the site see your IP address. Incognito does not encrypt traffic and does not change the IP. For complete invisibility, use a VPN, and use incognito only for local privacy. Read about data protection in the article Digital footprint.

Source: term "Incognito mode"

An IS incident is any event that violates or creates a threat of violation of the confidentiality, integrity or availability of information. Examples: password cracking, data leak, DDoS attack, infection with a ransomware virus, unauthorized access to a system. Read about types of threats in the article Cyber fraud.

Source: term "Information security incident"

The main types of incidents: malware (viruses, encryptors), unauthorized access (account hacking), data leaks (theft or accidental sending of confidential information), DDoS attacks (availability violation), social engineering (phishing), insider threats (employee actions). Each type requires its own approach to response and prevention. Read about protecting against them in the article Information security.

Source: term "Information security incident"

An event is any change in the system (for example, a failed login attempt, an antivirus trigger, a configuration change). An incident is an event that caused or could cause real damage (for example, a successful account hack, data theft, system infection). Not all events become incidents, but every incident begins with an event. Read about event monitoring in the article SIEM system.

Source: term "Information security incident"

When an incident is detected, it is necessary to: immediately isolate infected systems from the network, save all logs and evidence for the investigation, notify management and the security service, involve investigation specialists (forensics), notify regulators if necessary (Roskomnadzor, FSTEC, Bank of Russia). After elimination, conduct an analysis of the causes and update protection measures. Read about the response plan in the article SOAR.

Source: term "Information security incident"

The CIA triad: Confidentiality (access only for authorized persons), Integrity (protection from unauthorized changes) and Availability (data is available when needed). These three principles underlie all information security measures. An IS incident is a violation of one or more of these principles. Read more in the article Information security.

Source: term "Information security incident"

Incidents related to the leak of personal data (152-FZ) are subject to mandatory notification — within 24 hours from the moment of detection to Roskomnadzor. Also incidents at critical information infrastructure facilities — notification to FSTEC within 24 hours. For financial organizations — notification to the Bank of Russia in accordance with the regulator's requirements. Fines are provided for untimely notification.

Source: term "Information security incident"

Preventing incidents requires a comprehensive approach: regular software updates and elimination of vulnerabilities, use of antiviruses, EDR, SIEM and firewalls, regular training of employees in cybersecurity basics (especially the fight against phishing), implementation of secure access policies (MFA, the principle of least privilege), regular data backup (backup system) and penetration testing.

Source: term "Information security incident"

This is a method of identity verification that requires confirmation from different categories: a password (something you know) + an SMS code (something you have) or a fingerprint (something you are). Even if the password is stolen, without the second factor you will not be able to log in. It is like two locks on a door — one lock can be broken, but two is already almost impossible. Read about other protection methods in the article Information security.

Source: term "Multi-factor authentication (MFA)"

2FA (two-factor) uses exactly two factors (password + SMS code). MFA (multi-factor) — two or more factors (password + fingerprint + push notification). 2FA is a special case of MFA. If the system uses three factors, this is already MFA, not 2FA. Read about the difference between authentication and authorization in the article Authentication.

Source: term "Multi-factor authentication (MFA)"

The most reliable are hardware U2F keys (YubiKey, Rutoken). They are physically isolated from the internet, not subject to phishing and do not require data transmission over the network. The second most reliable are authenticator applications (Google Authenticator, Yandex Key, Authy). SMS is the least reliable method due to vulnerability to SIM swapping and message interception. Read about choosing a method in the article Biometrics.

Source: term "Multi-factor authentication (MFA)"

Dependence on external factors (phone, internet, cellular communication). If you lose the phone with the authenticator or end up in a zone without communication, access may be lost. Therefore, it is important to save the backup recovery codes that are issued when MFA is set up. Store them in a reliable place (for example, in a safe) — they will help restore access if you lose the device. Read about backup in the article Data backup.

Source: term "Multi-factor authentication (MFA)"

A classic example is logging into internet banking: entering a login and password (knowledge) + confirmation via an SMS code or push notification in the mobile bank (possession). Another example is logging into a Google account using a password + a code from Google Authenticator + a fingerprint (already three factors). In Russian government systems, login via ESIA with confirmation by SMS and an electronic signature is used. Read about setup in the article OAuth.

Source: term "Multi-factor authentication (MFA)"

In Google: Account settings → Security → Two-step verification → Follow the instructions. In Yandex: Account settings → Security → Two-factor authentication. In VKontakte: Settings → Security → Login confirmation. Usually you can choose a method: SMS, an authenticator application (Google Authenticator, Yandex Key) or push notifications. It is recommended to use an authenticator application — it is safer than SMS.

Source: term "Multi-factor authentication (MFA)"

Yes, for many government systems in Russia the use of MFA is mandatory or strongly recommended. For example, the State Services portal (ESIA) uses two-factor authentication — a password + an SMS code or confirmation through the application. To access Electronic Budget, SMIV and other government information systems, MFA using an electronic signature and additional factors is also required. This complies with the requirements of 152-FZ and 187-FZ.

Source: term "Multi-factor authentication (MFA)"

Tokenization is replacing sensitive data (for example, a card number) with a random set of characters — a token. The token has no value for hackers, since it does not contain the original information. Example: when paying via Apple Pay or Mir Pay, your card number is not transmitted to the seller; instead, a unique token is used. Even if the seller's database is hacked, the tokens cannot be used for other payments. Read about data protection in the article Information security.

Source: term "Tokenization"

This is the representation of real assets (real estate, stocks, gold, works of art) in the form of digital tokens on the blockchain. This allows dividing indivisible assets (for example, owning 0.5% of an apartment), accelerating transactions, increasing liquidity and ensuring transparency. Examples: tokenized real estate (RealT), tokenized gold (PAX Gold). Read about the blockchain in the article Blockchain.

Source: term "Tokenization"

The main risks of tokenization: technology limitations (tokens do not work in all systems), hacking risks in case of token compromise in a vulnerable system (if the Token Vault is hacked), regulatory risks (different legislation in countries regarding tokenized assets). However, in general, tokenization is significantly safer than storing data in open form or even encryption, since tokens do not contain the original information. Read about data protection in the article PCI DSS.

Source: term "Tokenization"

Encryption is a reversible transformation of data using a key. If you have the key, you can decrypt the data and get the original information. Encryption can be broken mathematically. Tokenization is replacing data with a random substitute (a token) that does not contain the original information. The token cannot be “decrypted”, since it simply does not store data. The connection between the token and the real data is stored separately in the Token Vault. Tokenization is considered safer for payment data. Read about encryption in the article Data encryption.

Source: term "Tokenization"

Tokenization is used in three main areas: information security (protection of card numbers, passport data, SNILS, INN), blockchain (digital assets, cryptocurrencies) and artificial intelligence (dividing text into tokens for neural networks). It is also used in payment systems (Apple Pay, Google Pay, Mir Pay, SBP), in access control systems and in IoT. Read about application in the article Artificial intelligence.

Source: term "Tokenization"

In the context of 152-FZ, tokenization helps protect personal data by replacing it with tokens. This allows organizations to process data without storing real information, which reduces the risks of leaks and regulator fines. Tokenization is one of the methods of personal data de-identification allowed by law. However, it is important that the token storage system (Token Vault) is protected in accordance with the requirements of 152-FZ and the use of cryptographic information protection.

Source: term "Tokenization"

In NLP (natural language processing), tokenization is the division of text into small fragments — tokens (words, subwords, syllables or characters). Models (ChatGPT, Yandex GPT, GigaChat) convert these tokens into numerical identifiers for processing. There are different approaches: word tokenization (division into words), subword (BPE, WordPiece) and character (division into separate characters). The choice of method affects the quality of the model's work. Read about artificial intelligence in the article Artificial intelligence.

Source: term "Tokenization"

Authentication is verifying the identity of a user. This is the answer to the question “Prove that you really are who you claim to be”. For example, entering a password, scanning a fingerprint or Face ID. Read about what happens next in the article Authorization.

Source: term "Authentication"

Authentication is identity verification (“Who are you?”). Authorization is determining access rights (“What are you allowed to do?”). Authentication always comes first, authorization follows. For example, when entering a bank, you first show your passport (authentication), and then the cashier checks whether you can withdraw money (authorization). Read more about the difference in the article Authorization.

Source: term "Authentication"

The main types: single-factor (only a password), two-factor (password + SMS code or push), multi-factor (three or more factors), passwordless (biometrics, email link, hardware key). The most secure are multi-factor and passwordless. Read about MFA in the article Multi-factor authentication (MFA).

Source: term "Authentication"

The three main factors: knowledge (password, PIN code), possession (phone, token, bank card) and inherence (fingerprint, face, voice, retina). For maximum security, a combination of all three factors is used (for example, password + token + fingerprint). Read about biometrics in the article Biometrics.

Source: term "Authentication"

The most reliable is passwordless authentication using hardware U2F keys (YubiKey, Rutoken) combined with biometrics. The second most reliable are authenticator applications (Google Authenticator, Yandex Key, Authy). SMS codes are the least reliable method due to vulnerability to SIM swapping and message interception. Read about protection in the article Information security.

Source: term "Authentication"

Adaptive (or contextual) authentication is an approach in which the system analyzes the context of the login: geolocation, device, time, user behavior. If everything is fine, the login proceeds without additional requests. If there are suspicions (for example, logging in from another country), the system requests an additional factor (an SMS code or push notification). This improves security without sacrificing convenience.

Source: term "Authentication"

In Russia, government systems (for example, the State Services portal, Electronic Budget, SMIV) use ESIA (Unified Identification and Authentication System) for citizens and organizations to log in. This allows using a single login and password for access to all government services. For enhanced security, two-factor authentication (password + SMS code or push notification) and an electronic signature are used.

Source: term "Authentication"

Authorization is checking a user's rights after logging into the system. It answers the question “What are you allowed to do?”. For example, after logging into your email, you can read your own letters, but you cannot read others'. Read about how the login happens in the article Authentication.

Source: term "Authorization"

Authentication is “Who are you?” (identity verification, login by password). Authorization is “What are you allowed to do?” (rights verification, access to files and functions). Authentication always comes first, authorization second. Read more in the article Authentication.

Source: term "Authorization"

RBAC (Role-Based Access Control) — access based on roles. Rights are assigned to roles (administrator, manager, employee), not to each user separately. This is simple and convenient for management. Read about rights configuration in the article Access control.

Source: term "Authorization"

Authentication always comes first — you prove who you are (enter a password). Only after that the system checks your rights (authorization). Without authentication, authorization is impossible. Read about the processes in the article Authentication.

Source: term "Authorization"

RBAC (Role-Based Access Control) is an authorization model where access rights are assigned to roles, not to people. For example, all “Administrators” can delete files, while all “Employees” can only read them. If an employee is promoted to administrator, they automatically receive new rights. Read about access rights in the article Access control.

Source: term "Authorization"

Voice biometrics analyzes the unique characteristics of the voice (timbre, frequency, rhythm, speech rate), and face recognition — the geometry of the face. Both technologies are used for identification, but voice biometrics works through telephone channels and does not require a camera, which makes it convenient for call centers and remote identification.

Source: term "Voice biometrics"

Voice biometrics is used in banks (for confirming operations by phone and logging in to mobile applications), in the Unified Biometric System (UBS) for state services, as well as in corporate systems for protecting access to confidential information.

Source: term "Voice biometrics"

Voice biometrics is considered safe, since the voiceprint is difficult to fake. Modern systems use liveness detection for protection from voice recordings and deepfakes. Data is stored in encrypted form using CIPF, which meets the requirements of 152-FZ.

Source: term "Voice biometrics"

Yes, the use of voice biometrics is voluntary. A citizen has the right to refuse the collection of biometric data in the Unified Biometric System by submitting an application through the MFC or the State Services portal.

Source: term "Voice biometrics"

Liveness detection in voice biometrics protects against attacks using voice recordings. The system can request the utterance of a random phrase, analyzes micro-pauses, natural articulation noises (breathing, swallowing) that cannot be reproduced with a recording, and also checks the acoustic characteristics of the room.

Source: term "Voice biometrics"

Modern voice biometrics systems take into account natural changes in the voice during colds, stress, age-related changes or fatigue. They use adaptive models that gradually update the user's template at each successful authentication session.

Source: term "Voice biometrics"

No special equipment is required for the use of voice biometrics — any device with a microphone is enough: a smartphone, computer, tablet or an ordinary telephone set. This makes the technology accessible and easy to scale for any organization.

Source: term "Voice biometrics"

2D recognition works with a flat image and is vulnerable to attacks using photographs and videos. 3D recognition uses a three-dimensional model of the face, analyzing depth and relief, which makes it resistant to forgeries and more accurate. 3D technology also works with changing lighting and angle, as well as with partial overlap of the face.

Source: term "3D face recognition"

The technology is used in smartphones (Face ID, Face Unlock), access control systems, checkpoints in airports, ATMs with biometrics, video surveillance systems and in the Unified Biometric System (UBS). It is also actively used at CII facilities and in government systems.

Source: term "3D face recognition"

Modern 3D systems use liveness detection — analysis of skin texture, micro-movements, thermal radiation and depth. This makes it possible to distinguish a living person from a silicone mask or a 3D-printed model. However, high-quality masks still represent a theoretical threat.

Source: term "3D face recognition"

Access control systems (ACS) integrate 3D terminals for identifying employees when passing through turnstiles or doors. This ensures a high level of security and excludes the possibility of transferring a pass to another person. Biometric data is stored locally or in a protected cloud using CIPF.

Source: term "3D face recognition"

Specialized equipment is used for 3D recognition: 3D scanners with built-in depth cameras (structured light, laser projection, stereo cameras or ToF sensors). In smartphones, compact modules (for example, TrueDepth) are used. For corporate systems — stationary terminals or embedded modules for turnstiles.

Source: term "3D face recognition"

3D recognition uses active infrared lighting (laser projectors or IR illumination), so it works in complete darkness as effectively as in good lighting. The infrared camera records the depth and relief of the face regardless of visible light, which makes the technology all-weather and 24/7.

Source: term "3D face recognition"

The use of 3D biometrics is regulated by 152-FZ "On Personal Data", 187-FZ "On CII Security" and orders of FSTEC of Russia. For government systems, certification of equipment and compliance with requirements for the protection of biometric personal data is required. Collection of biometrics is possible only with the written consent of the subject.

Source: term "3D face recognition"

Fingerprints are an external feature that can be copied, left on a surface or damaged. Vein pattern is an internal subcutaneous feature that cannot be copied or forged. The technology is also contactless and independent of the state of the skin, which makes it more reliable.

Source: term "Vein pattern recognition"

The technology is used in access control systems for especially protected facilities, in banking systems to confirm transactions, at checkpoints and in government systems, including CII facilities. It is also used in healthcare for patient identification and in the transport industry.

Source: term "Vein pattern recognition"

The vein pattern is an internal biometric feature that cannot be copied, photographed or reproduced without access to a living hand. Even if an attacker gets access to the template, he will not be able to use it for authentication, since the system requires live scanning. Modern systems also use liveness detection.

Source: term "Vein pattern recognition"

ACS with vein pattern recognition support are installed on turnstiles and doors for employee identification. This ensures the maximum level of security. Data is stored locally or in a protected database. Such solutions are often integrated with biometric terminals via Wiegand, TCP/IP or RS-485 protocols.

Source: term "Vein pattern recognition"

To operate the system, a vein scanner is required, which can be made in the form of a standalone terminal or an embedded module. The scanner uses an IR camera to obtain an image of the veins and a built-in processor to create a biometric template. A server is also needed to store templates and manage access.

Source: term "Vein pattern recognition"

A finger scanner reads the vein pattern of one finger, takes up less space and is often used in smartphones and compact terminals. A palm scanner analyzes a larger area with more veins, which provides higher accuracy and reliability. The choice depends on the required security level.

Source: term "Vein pattern recognition"

The use of biometric data, including the vein pattern, is regulated by Federal Law No. 152-FZ "On Personal Data". For use in government systems and at CII facilities, compliance with the requirements of 187-FZ and orders of FSTEC of Russia is also required.

Source: term "Vein pattern recognition"

Static biometrics (fingerprints, face, retina) checks the identity once at login and is vulnerable to forgery. Behavioral biometrics works continuously throughout the session, analyzing behavioral patterns: typing speed, mouse movements, manner of working with a device. It is practically impossible to forge, since the patterns are subconscious and unique.

Source: term "Behavioral biometrics"

The technology is used in banking applications to protect against fraud, in corporate systems for controlling employee access, in government information systems for data protection, in the gaming industry to fight bots. It also integrates with DLP systems to detect insider threats and with SIEM systems.

Source: term "Behavioral biometrics"

Yes, behavioral biometrics is actively used in mobile applications. The system analyzes sensor data: force of pressing on the screen, speed and length of swipes, the angle of the device (accelerometer), the manner of holding the phone. This allows continuous protection of banking applications.

Source: term "Behavioral biometrics"

During a social engineering attack, the user may act under pressure or in a state of stress. This changes behavioral patterns: the number of typing errors increases, the typing speed changes, movements become sharper. The system records these changes and can request additional authentication (for example, through MFA).

Source: term "Behavioral biometrics"

Fatigue, stress, hand injuries, changing devices or keyboards, as well as software that changes mouse behavior can affect behavioral patterns. Modern systems take these factors into account and adapt the profile using ML algorithms.

Source: term "Behavioral biometrics"

Modern behavioral biometrics systems provide accuracy up to 95-99%, but errors are possible. False positives — when the system blocks a legitimate user due to non-standard behavior. False negatives — when the system lets through an attacker whose patterns are close to normal.

Source: term "Behavioral biometrics"

The implementation of behavioral biometrics requires collecting and processing data in real time, as well as configuring ML algorithms. Integration with existing authentication systems and SIEM also takes time. Professional design and staff training will help.

Source: term "Behavioral biometrics"

Biometric data is raw samples: a photo of a face, a voice recording, a fingerprint. A biometric template is a mathematical model created on the basis of these data. It is impossible to restore the original data from a template, which makes it safer for storage.

Source: term "Biometric template"

In the Unified Biometric System (UBS), templates are stored in encrypted form using certified CIPF. Access to templates is strictly limited, all operations are logged. Hashing and salt are applied.

Source: term "Biometric template"

A biometric template is created on the basis of unique characteristics of a person that cannot be changed. If a template is compromised, it cannot be "replaced" like a password. However, the cancelable biometrics technology can be used.

Source: term "Biometric template"

ISO/IEC 19794 is an international standard that defines the formats of biometric templates for various types of data: fingerprints, face images, voice, vein patterns, iris and others. The standard ensures compatibility between different systems.

Source: term "Biometric template"

There are physiological templates (fingerprints, face, veins, iris, DNA), behavioral templates (voice, signature, gait, keyboard handwriting) and multimodal templates (a combination of several features). Multimodal systems provide higher accuracy.

Source: term "Biometric template"

Cancelable biometrics is a technology in which various derivative templates are created from the original biometric data (using special transformations). If one template is compromised, another can be used, created on the basis of the same original data.

Source: term "Biometric template"

In Russia, the requirements for storing biometric templates are established by 152-FZ "On Personal Data" and FSTEC orders. Templates must be stored in encrypted form using certified CIPF, on servers located on the territory of the Russian Federation.

Source: term "Biometric template"

On the cover of an electronic passport there is an icon of a microcircuit (a camera with a dot in the middle). It also contains 46 pages (instead of 36 in the old format), and the first page is made of plastic. The validity period of such a passport is 10 years instead of 5 years.

Source: term "Electronic passport (RFID foreign passport)"

The RFID chip stores the biographical data of the holder, a digital photograph, and in some countries — fingerprints. The data is protected by cryptographic keys (BAC and EAC protocols) and cannot be read without physical contact and authorization.

Source: term "Electronic passport (RFID foreign passport)"

At border crossing points, NFC readers are installed that activate the chip at a distance of up to 10 cm. The system authenticates the chip, reads the data and automatically verifies it with the information on the passport pages.

Source: term "Electronic passport (RFID foreign passport)"

Reading the chip requires physical contact at a distance of up to 10 cm and knowledge of access keys (BAC). Without these keys, the chip does not issue data. Covert reading is impossible, since the attacker needs to be in close proximity. The data on the chip is also encrypted.

Source: term "Electronic passport (RFID foreign passport)"

The validity period of an electronic foreign passport is 10 years from the date of issue (unlike 5 years of a passport of the old format). Electronic passports are also issued for children for a period of 5 years.

Source: term "Electronic passport (RFID foreign passport)"

An electronic passport allows passing automated border control (e-Gates) in many countries, which significantly speeds up the passage of passport control. It also contains more pages for visas (46 pages) and has increased protection from forgeries.

Source: term "Electronic passport (RFID foreign passport)"

Yes, an electronic passport is safe. The data on the chip is encrypted, and physical proximity (up to 10 cm) and knowledge of the access keys from the MRZ are required to read it. Modern EAC protocols protect even fingerprints. This complies with the requirements of 152-FZ.

Source: term "Electronic passport (RFID foreign passport)"

3D face recognition, fingerprint scanning, vein pattern recognition and iris recognition are used. Multimodal terminals combine several methods.

Source: term "Biometric terminal"

Biometric terminals are used at CII facilities, in government institutions, at border crossing points, in banks and at enterprises with increased security requirements.

Source: term "Biometric terminal"

Modern terminals use liveness detection — a technology that distinguishes a live object from a counterfeit. Conductivity of the skin, micro-movements and blood flow are checked.

Source: term "Biometric terminal"

Terminals integrate with access control systems via network interfaces or protocols (Wiegand, RS-485). Data is transferred to SIEM systems.

Source: term "Biometric terminal"

The cost varies from 10,000 to 300,000 rubles depending on the type of biometrics and functionality. Models with 3D face recognition can cost from 80,000 to 300,000 rubles.

Source: term "Biometric terminal"

Yes, most terminals support time tracking. The system records the passage time, allowing automatic report generation.

Source: term "Biometric terminal"

An ACS (access control system) is an electronic "doorman" that solves three main tasks: it restricts entry for outsiders, lets authorized people in on a schedule and keeps track of working time. It is a hardware-software complex that automates access control in offices, banks and production facilities. You can learn more about the principles of operation in the section on access control.

Source: term "ACS (Access Control System)"

The access control system includes four main groups of equipment: identifiers (cards, key fobs, biometric data), readers (for receiving a signal from the identifier), controllers (the "brain" of the system that makes the decision) and actuators (electric locks, turnstiles, barriers). The choice of equipment depends on the scale of the facility and security tasks. Our specialists will help you choose the optimal configuration and carry out professional ACS installation.

Source: term "ACS (Access Control System)"

ACS are classified by management method (standalone and networked), by identifier type (cards, keys, biometrics) and by actuator type (locks, turnstiles, barriers). For facilities with high security requirements, biometric ACS are the optimal choice, using fingerprints or face for identification, which makes them as reliable and convenient as possible.

Source: term "ACS (Access Control System)"

An ACS at an enterprise solves a set of tasks: it ensures security, preventing unauthorized access, automates employees' working time records and helps control discipline. It is not just a means of restricting access, but an important tool for increasing the efficiency of business processes. A properly designed and installed system becomes a reliable foundation for the entire security system of the organization.

Source: term "ACS (Access Control System)"

ACS installation is a complex process that includes design, equipment selection, laying low-voltage networks, installation and commissioning of all devices. It is important to properly integrate all system components: controllers, readers, locks and software. The Fintech company provides installation and commissioning of hardware-software complexes, guaranteeing reliable and uninterrupted operation of the equipment.

Source: term "ACS (Access Control System)"

In educational institutions, ACS is used to organize the access regime, control student attendance and ensure security on school premises. The access control system allows automatically recording entry and exit times, restricting access of outsiders and quickly responding to emergencies. It is one of the key elements of a modern security system in education, which helps create a safe environment for students and staff.

Source: term "ACS (Access Control System)"

An access control system (ACS) is a set of software and hardware tools that automatically determines who is allowed to enter. It consists of identifiers (cards, biometrics), readers, controllers (the "brain" of the system) and locking devices (locks, turnstiles). Main functions: access restriction, working time records and security. The Biomark and Biovizum products integrate with ACS. The design service will help implement the system.

Source: term "ACS (Access Control System)"

A checkpoint is a specially equipped place for controlling access to the territory of an organization or through the state border. At internal checkpoints, control of people's passage and vehicle traffic is carried out using ACS, turnstiles and document readers. The APM-1 and APM-2 equipment provides automatic document verification. Installation services will help organize an effective checkpoint.

Source: term "Checkpoint (control checkpoint, CCP)"

A checkpoint (CCP) is a specially equipped place for controlling the passage of people and vehicle traffic to a protected territory. At the state border, these are checkpoints with border and customs control. At internal facilities, these are security posts with ACS, barriers and turnstiles. The SPV-7024M equipment provides document reading. Installation services will help organize a checkpoint.

Source: term "Checkpoint (control checkpoint, CCP)"

Checkpoints operate on Russia's border in the directions of CIS countries, Georgia, Mongolia and China. The main road checkpoints: Verkhniy Lars (Georgia), Zabaykalsk (China), Mashtakovo (Kazakhstan). In the European direction there are restrictions, many checkpoints are closed. The APM-1 and SPV-7024M equipment is used to automate document verification at checkpoints. Installation services will help equip a checkpoint.

Source: term "Checkpoint (control checkpoint, CCP)"

More than 300 checkpoints operate on the border of Russia: road (road auto checkpoints), air (airports), railway, sea and river. Key road checkpoints: Zabaykalsk (China), Verkhniy Lars (Georgia), Mashtakovo (Kazakhstan), Burachki (Latvia). The SPV-7024M and APM SPD equipment is used to automate document verification. Installation services will help equip a checkpoint.

Source: term "Checkpoint (control checkpoint, CCP)"

In the Russian Federation, 313 checkpoints across the state border operate (out of 388 established). Of these, there are more than 100 road checkpoints. All checkpoints are equipped with document verification equipment, including APM-1 and SPV-7024M. Installation services will help equip road checkpoints with modern equipment.

Source: term "Checkpoint (control checkpoint, CCP)"

Control checkpoints are needed to regulate access to protected territories, ensure security and control the movement of people and vehicles. At the state border, checkpoints carry out border and customs control. At internal facilities, checkpoints with ACS and APM-1 control the access of employees and visitors. Installation services will help organize an effective checkpoint.

Source: term "Checkpoint (control checkpoint, CCP)"

The checkpoint regime is the established rules for entry, stay and exit of persons, vehicles, import and export of cargo. For internal checkpoints, the regime determines the rules for passage and entry to the protected territory. Automation of the checkpoint using APM-1 and SPV-7024M ensures compliance with the regime. Installation services will help organize a checkpoint in accordance with the requirements.

Source: term "Checkpoint (control checkpoint, CCP)"

OCR (Optical Character Recognition) recognizes printed text. ICR (Intelligent Character Recognition) is a more advanced technology that recognizes handwritten text, using machine learning to analyze the variability of handwriting. ICR is often used in banks to process questionnaires and applications.

Source: term "OCR (Optical Character Recognition)"

Among the free OCR solutions, Tesseract (an open source engine from Google), Google Cloud Vision API, ABBYY FineReader Online (limited version), OCR.space, Microsoft OCR (built into Windows) are popular. Paid solutions with support and high accuracy are more often chosen for corporate use.

Source: term "OCR (Optical Character Recognition)"

In electronic document workflow systems, OCR automatically recognizes incoming documents (invoices, waybills, contracts), extracts key data and directs them to the corresponding business processes. This allows reducing manual data entry by 80-90%.

Source: term "OCR (Optical Character Recognition)"

To recognize passports, OCR is used in tandem with MRZ recognition. OCR extracts data from the visual zone, and MRZ recognition reads the machine-readable zone to verify the data. The joint use of these technologies provides high accuracy (up to 99.5%).

Source: term "OCR (Optical Character Recognition)"

Yes, modern OCR systems support multilingual recognition. Some solutions can automatically determine the language of a document. Tesseract, for example, supports more than 100 languages, ABBYY FineReader — more than 190.

Source: term "OCR (Optical Character Recognition)"

The accuracy of modern OCR depends on the quality of the original image and the type of document. For high-quality images, accuracy reaches 99-99.8%. For documents of poor quality, accuracy can drop to 80-95%. The use of neural network models significantly increases accuracy.

Source: term "OCR (Optical Character Recognition)"

For local OCR, a computer with sufficient performance is required: an Intel Core i5 processor or higher, 8-16 GB RAM, preferably a GPU. For cloud OCR solutions, any device with Internet access is enough.

Source: term "OCR (Optical Character Recognition)"

RFID readers operate at different frequencies and have a range from several centimeters to tens of meters. NFC readers are a special case of RFID at 13.56 MHz with a range of up to 10 cm, optimized for secure transactions.

Source: term "NFC reader"

NFC readers are used in payment terminals (for contactless payment), in ACS (for passing by cards and smartphones), at border crossing points (for reading electronic passports), in logistics.

Source: term "NFC reader"

Yes, most modern smartphones (Android and iPhone) support NFC and can operate in reader mode. It is necessary to install a special application (for example, NFC Tools). The smartphone can read NFC tags, smart cards and electronic passports (with ICAO support).

Source: term "NFC reader"

An NFC reader makes it possible to read electronic passports (foreign passports with an RFID chip), identity documents, driver's licenses with a chip, bank cards with contactless payment, as well as corporate passes and transport cards.

Source: term "NFC reader"

Data is protected at several levels: the limited range (up to 10 cm) prevents interception, and encryption (for example, AES) is used for transactions. For electronic passports, cryptographic authentication (BAC, EAC) is applied.

Source: term "NFC reader"

NFC readers support ISO 14443, ISO 15693 and NFC Forum specifications. The ICAO 9303 standard is used for reading electronic passports, and EMVCo standards for payment systems.

Source: term "NFC reader"

The cost depends on the type and functionality. USB readers for PCs cost from 1,500 to 5,000 rubles. Stationary readers for ACS — from 5,000 to 20,000 rubles. Portable readers for document checking — from 20,000 to 100,000 rubles.

Source: term "NFC reader"

The terms LPR and ANPR are often used as synonyms. ANPR is more often used in Europe and international standards, LPR — in the USA. Both terms describe the same technology of automatic car number recognition.

Source: term "Car number recognition system (LPR/ANPR)"

Modern LPR/ANPR systems achieve accuracy of 95-99% in good lighting conditions. Accuracy decreases in bad weather, contaminated numbers, non-standard formats or high speed. The use of neural networks and special cameras with IR illumination increases accuracy.

Source: term "Car number recognition system (LPR/ANPR)"

LPR/ANPR systems are used on toll roads, parking lots, in Safe City systems, at border crossing points of enterprises, in logistics centers and in law enforcement.

Source: term "Car number recognition system (LPR/ANPR)"

Specialized cameras with a high-speed shutter (up to 1/10000 s), IR illumination and tracking algorithms are used for high-speed recognition. The system captures several frames and selects the best one for recognition. Modern systems operate at speeds up to 200 km/h.

Source: term "Car number recognition system (LPR/ANPR)"

LPR/ANPR systems integrate with ACS for automatic passage control: when a number from the employee or guest database is recognized, the system opens the barrier. Event logs are transferred to SIEM.

Source: term "Car number recognition system (LPR/ANPR)"

Modern systems use deep learning technologies (neural networks) for license plate detection and character recognition. Popular architectures: YOLO for detection, Tesseract OCR for character recognition.

Source: term "Car number recognition system (LPR/ANPR)"

Ordinary cameras can be used, but their effectiveness will be lower. Specialized cameras have several advantages: high resolution, fast shutter, IR illumination for night shooting, wide dynamic range.

Source: term "Car number recognition system (LPR/ANPR)"

BPMS (Business Process Management System) is a business process management system that helps implement the concept of process management in practice. It allows modeling company processes, automating their execution and controlling task completion. BPMS is based on models in BPMN notation, which the system converts into executable code. Learn more about automation approaches in the technologies section.

Source: term "BPMS (Business Process Management System)"

BPM (Business Process Management) is an approach in which the company's work is built in the form of clear algorithms. First, processes are modeled as diagrams, then automated in BPMS, and then analyzed to find bottlenecks. This allows bringing order to chaos and automating routine tasks. You can familiarize yourself with the basic principles in our glossary.

Source: term "BPMS (Business Process Management System)"

A BPM system (BPMS) is a program for modeling, automating, executing and analyzing business processes. It translates chaotic tasks and verbal agreements into a clear digital algorithm, uniting employees, data and IT systems into a single workflow. Any BPM system is based on a graphical process diagram in BPMN notation. Our products, such as SINTEZ-M, implement the full BPM cycle.

Source: term "BPMS (Business Process Management System)"

The abbreviation BPM has three main meanings. In music — Beats Per Minute, a tempo indicator. In medicine — heart rate. In business and IT — Business Process Management, the concept of managing an organization through processes. In the context of our work, BPM is a management approach implemented using BPMS. Read more about the methodology in the services section.

Source: term "BPMS (Business Process Management System)"

The main task of BPMS is to help companies define, automate and manage business processes. The system replaces long operations performed manually with optimized workflows in business applications. BPMS also collects metrics for analyzing bottlenecks and continuous process improvement. To build an effective automation architecture, use SINTEZ-M and our other products.

Source: term "BPMS (Business Process Management System)"

A BPMS administrator manages all applications of the BPM platform, including user access rights, process configuration, execution monitoring and integration administration. He is also responsible for training employees to work with the system. To train administrators, we offer training services and consultations on configuring SINTEZ-M and SKIF-BP products.

Source: term "BPMS (Business Process Management System)"

BPM (Business Process Management) is a management discipline and methodology, while BPMS (Business Process Management System) is the software that implements it in practice. BPM defines the approach — modeling, automation, monitoring and optimization of processes, and BPMS is the tool that automates processes modeled in BPMN notation. Our products, such as SINTEZ-M, implement the full BPM cycle in a single environment.

Source: term "BPMS (Business Process Management System)"

BPMN is an international language for drawing business process diagrams, understandable to both business and IT specialists. It allows clearly showing who, what and in what sequence does to achieve a goal. BPMN diagrams can be directly executed in BPMS systems, which eliminates the gap between design and implementation. You can familiarize yourself with the basic principles in our glossary.

Source: term "BPMN (Business Process Model and Notation)"

BPMN focuses on workflows and business processes, showing who and what does to achieve a business goal. UML is a universal language for designing software architecture, classes, databases and logic within information systems. BPMN is understandable to managers and analysts, UML — mainly to developers. BPMN diagrams can be directly executed in BPMS, and UML — transformed into program code. Read more about notations in the our technologies section.

Source: term "BPMN (Business Process Model and Notation)"

Professional editors are available for creating BPMN diagrams: Camunda Modeler (free, with execution support), Bizagi Modeler (for beginners), as well as online services Draw.io and Miro for teamwork. In corporate environments, Microsoft Visio is often used. If you plan to automate processes, choose tools with BPMN 2.0 support and integration with BPMS. Our products, such as SINTEZ-M, include a built-in BPMN model designer.

Source: term "BPMN (Business Process Model and Notation)"

A BPMN system (or BPMS) is software for automating business processes, where the work logic is built using graphical diagrams in the BPMN language. The system reads the diagram, converts it into code and automatically distributes tasks between participants, tracks metrics and allows making changes on the fly. Such systems are used to manage approvals, order processing and HR processes. Read more about the capabilities on the SINTEZ-M page.

Source: term "BPMN (Business Process Model and Notation)"

IDEF0 is a functional modeling notation that shows a system as a set of interrelated functions, but does not define the sequence of their execution in time. BPMN, on the contrary, is focused on workflows and time sequences, which allows not only describing, but also automating processes in BPMS. BPMN has strict formal semantics for machine interpretation, which IDEF0 does not have. Learn more about notations in our glossary.

Source: term "BPMN (Business Process Model and Notation)"

BPMN remains a relevant standard, especially in the AI era. Enterprises still need control tools, audit logs, retries and clear definition of responsible parties. If AI is the brain, then orchestration through BPMN is the nervous system for coordinated actions. BPMN models can be integrated with low-code platforms for rapid automation. Read more about application in the technologies section.

Source: term "BPMN (Business Process Model and Notation)"

BPMN 2.0 is an international standard (ISO/IEC 19510) developed by the Object Management Group and supported by all leading BPMS vendors. It provides a unified graphical language understandable to both business analysts and developers, and its strict formal semantics allow process models to be executed directly on a BPM engine without manual programming. This makes BPMN the de facto standard for process automation projects in banks, government bodies and industry.

Source: term "BPMN (Business Process Model and Notation)"

RPA (Robotic Process Automation) is a technology in which software robots imitate human actions at the computer. They "look" at the screen, press buttons, copy text and transfer data between programs faster and without errors. RPA bots work through the same interface as a human, so they do not require modifications of IT systems. Our SINTEZ-M platform includes a built-in RPA module. Learn more about the capabilities in the technologies section.

Source: term "RPA (Robotic Process Automation)"

RPA (Robotic Process Automation) is a technology for creating software robots that imitate human actions at the computer: clicks, text input, data copying. Robots work on top of existing programs (browser, Excel, CRM, 1C), freeing people from monotonous routine. The main difference of RPA is that robots work through the interface, so the company does not need to change IT systems. The RPA module is part of the SINTEZ-M platform. The training service will help master RPA development.

Source: term "RPA (Robotic Process Automation)"

RPA stands for Robotic Process Automation. It is a technology in which software robots imitate human actions when working with a computer. They interact with applications the same way an employee does, but faster and without errors. In our SINTEZ-M platform, the RPA module is integrated with BPMN processes. Read more about implementation in the services section.

Source: term "RPA (Robotic Process Automation)"

An RPA system (or RPA platform) is a software environment for developing, launching and managing robots that imitate user actions in digital systems. It includes a visual designer for creating bots, a control and monitoring console, as well as integration tools with external systems. Our SINTEZ-M platform includes a full-featured RPA module. The design service will help design a robotization architecture.

Source: term "RPA (Robotic Process Automation)"

The essence of RPA is the use of software robots to perform repetitive office tasks: data extraction, form filling, file moving, document processing. Robots work through the user interface the same way as a human, but faster and without errors. This allows freeing employees for more complex tasks. Our SINTEZ-M platform includes an RPA module integrated with the low-code environment. Learn more in the technologies section.

Source: term "RPA (Robotic Process Automation)"

RPA is best suited for automating repetitive, rule-based operations performed in large volumes: data entry, copying data between systems, filling in forms, generating reports and document processing. Such tasks are typical where systems have no open APIs or integration would be too expensive. Our SINTEZ-M platform includes an RPA module for automating such operations. Learn more in the technologies section.

Source: term "RPA (Robotic Process Automation)"

Yes, RPA can be studied independently through online courses and documentation. Many platforms offer free versions for learning. Training materials and courses are available for working with our SINTEZ-M platform. The training service from Fintech allows mastering RPA development under the guidance of experts. Read more about training approaches in the technologies section.

Source: term "RPA (Robotic Process Automation)"

In the business context, BPM means Business Process Management. It is a discipline that treats processes as organization assets and ensures their continuous improvement. BPM is implemented using methodologies and tools, including BPMS. You can familiarize yourself with the basic principles in our glossary.

Source: term "BPM (Business Process Management)"

The word BPM most often means Beats Per Minute in music and medicine or Business Process Management in management. In music, BPM shows the tempo of a composition, in medicine — the heart rate, in business — an approach to process management. In the context of our work, BPM is a methodology supported by BPMS and the BPMN notation.

Source: term "BPM (Business Process Management)"

The classic BPM life cycle consists of five stages: design (modeling in BPMN notation), implementation (automation on a BPMS), execution, monitoring (collection of metrics and KPI control) and optimization (bottleneck analysis). The cycle repeats continuously, ensuring constant evolution of the organization's processes. The SINTEZ-M platform implements the full BPM cycle in a single environment.

Source: term "BPM (Business Process Management)"

BPM is an approach in which the company's work is built in the form of clear algorithms. First, processes are modeled as diagrams, then automated in a special BPMS system, and then analyzed to find bottlenecks. This allows bringing order to chaos, automating routine and tracking where time and money are lost. Our products, such as SINTEZ-M, help implement BPM in your organization.

Source: term "BPM (Business Process Management)"

BPM turns an organization into a system of manageable end-to-end processes instead of isolated departments. This ensures transparency of operations, faster decision-making, lower costs and continuous improvement of quality. Properly organized process management allows the company to respond flexibly to market changes. To implement BPM, specialized BPMS and the BPMN notation are used.

Source: term "BPM (Business Process Management)"

The benefits of BPM include process transparency, reduced costs for routine operations, control over execution deadlines, identification of bottlenecks and data for making management decisions. Process management also improves customer satisfaction by reducing service times. Our products, such as SINTEZ-M, help implement these benefits in your organization.

Source: term "BPM (Business Process Management)"

Implementation of BPM begins with modeling key processes in BPMN notation, then the processes are automated on a BPMS platform, after which metrics are collected and bottlenecks are analyzed for continuous improvement. It is important to involve business analysts and process owners at every stage. Our products SINTEZ-M and SKIF-BP implement the full BPM cycle.

Source: term "BPM (Business Process Management)"

The main notations: BPMN (the standard for detail and automation, supported by most BPMS), IDEF0 (for high-level functional analysis), EPC (for process modeling in SAP). The choice of notation depends on the goal.

Source: term "Business process modeling"

The AS-IS model describes the current state of the process with all errors, delays and inefficiencies. The TO-BE model describes the target state after optimization and implementation of changes, including automation. The transition from AS-IS to TO-BE is the essence of business modeling.

Source: term "Business process modeling"

Process models (especially in BPMN notation) can be directly loaded into BPMS for automatic execution. The system guides users step by step, controls deadlines and automatically transfers tasks between performers. This reduces manual labor by 30-50%.

Source: term "Business process modeling"

BPMN editors (Microsoft Visio, Draw.io), specialized BPMS systems (low-code platforms with built-in editors) and corporate solutions for enterprise architecture modeling (for example, ARIS) are used for modeling.

Source: term "Business process modeling"

Basic BPMN modeling can be mastered in a few days. But professional modeling requires an understanding of enterprise architecture, analysis methodologies and industry knowledge. Training courses help quickly form the necessary competencies.

Source: term "Business process modeling"

Business process models should be reviewed and updated at least once a year, as well as for any significant changes in the company: reorganization, implementation of new systems, changes in legislation or strategy.

Source: term "Business process modeling"

The main mistakes: excessive detail, lack of coordination with real performers, modeling the desired instead of the actual, ignoring exceptions and errors, the absence of measurable performance indicators (KPI). Professional design helps avoid these problems.

Source: term "Business process modeling"

APCS (Automated Process Control System) is the general name of the entire automation system. SCADA is a part of APCS, specifically the software for supervisory control and data acquisition, which provides the human-machine interface (HMI).

Source: term "SCADA (Supervisory Control and Data Acquisition)"

The Russian market offers SCADA systems: MasterSCADA 4D, KASKAD, Simple-Scada, Alfa Platforma, Rapid SCADA. Most of them are included in the Register of Domestic Software and used for import substitution at CII facilities.

Source: term "SCADA (Supervisory Control and Data Acquisition)"

SCADA systems for CII facilities must comply with the requirements of 187-FZ. This includes channel encryption using CIPF, access control, logging of all actions and integration with intrusion detection systems.

Source: term "SCADA (Supervisory Control and Data Acquisition)"

Yes, SCADA systems can work in isolated networks (without an Internet connection) for security. Remote access is implemented through secure VPN channels or dedicated communication lines.

Source: term "SCADA (Supervisory Control and Data Acquisition)"

The cost of SCADA implementation depends on the scale of the system: the number of I/O points, the number of workstations, requirements for redundancy and integration. Basic solutions start from 7,500 rubles per license.

Source: term "SCADA (Supervisory Control and Data Acquisition)"

Industrial protocols are used in SCADA: Modbus, OPC UA, DNP3, IEC 61850, Profibus and Profinet. The choice of protocol depends on the equipment.

Source: term "SCADA (Supervisory Control and Data Acquisition)"

SCADA is the basis for collecting data that is then used in MES and ERP systems. This makes it possible to create digital twins of production, optimize processes and implement predictive analytics. SCADA is the foundation for the transition to Industry 4.0.

Source: term "SCADA (Supervisory Control and Data Acquisition)"

BPMS is a full-fledged platform for business process management, including an interface for modeling, monitoring and administration. A Workflow Engine is the core of BPMS, a library or service that executes processes. A Workflow Engine can be embedded in an existing application.

Source: term "Workflow Engine"

Among the popular solutions: Camunda, Temporal, Activiti, jBPM. Russia is developing its own Workflow Engine based on the SINTEZ-M low-code platform.

Source: term "Workflow Engine"

Yes, some Workflow Engines (for example, Temporal, AWS Step Functions) use not BPMN, but their own process description languages. However, BPMN remains the most convenient for business users.

Source: term "Workflow Engine"

Low-code platforms use a Workflow Engine as a built-in component for executing business processes. The user models the process in a visual editor, and the Workflow Engine automatically executes it.

Source: term "Workflow Engine"

A Workflow Engine can exist as a standalone product (a library for embedding) or as the core of a BPMS system. Embedded Workflow Engines allow adding process management to an existing application.

Source: term "Workflow Engine"

A Workflow Engine uses transactionality mechanisms, guaranteeing that either each process step is fully executed or rolled back in case of an error. For long-running processes, timers and retry mechanisms are supported.

Source: term "Workflow Engine"

Yes, a Workflow Engine is well suited for a microservice architecture, providing orchestration of calls between microservices. In this case, the Workflow Engine acts as a coordinator.

Source: term "Workflow Engine"

A BPMN model is a static graphic description of a process. A digital twin is a dynamic model that uses real data to simulate the behavior of a process. A digital twin can be executed on a Workflow Engine and predict results in real time.

Source: term "Process digital twin"

Process digital twins are used in industry, logistics, banking, public administration and in document workflow systems.

Source: term "Process digital twin"

Simulation modeling tools (AnyLogic, Simio), Process Mining systems (Celonis), as well as BPMS and low-code platforms with simulation support are used.

Source: term "Process digital twin"

A digital twin allows testing changes without risk to current work. It shows how changes will affect execution time, staff load and financial indicators. A Workflow Engine is used to execute the model.

Source: term "Process digital twin"

Process Mining is a technology of automatic extraction of process models from event logs of information systems. These models are used to create digital twins that reflect the real state of processes.

Source: term "Process digital twin"

Event logs from information systems (ERP, CRM, BPM), data about operation execution time, resource load, operation cost, as well as input and output flow data are needed.

Source: term "Process digital twin"

Yes, a process digital twin is ideal for staff training. Employees can practice actions in a virtual environment without risk to real work.

Source: term "Process digital twin"

No-code completely excludes programming. Low-code assumes minimal coding for complex logic and high-load systems.

Source: term "No-code platform"

Landing pages, internal accounting systems, process automation, self-service portals, MVP prototyping.

Source: term "No-code platform"

Craftum, Nethouse, Bipium, UMA. For complex tasks, SINTEZ-M is used.

Source: term "No-code platform"

Most platforms use TLS/AES-256 encryption. For personal data, certified Low-code platforms with CIPF support are recommended.

Source: term "No-code platform"

Most No-code platforms handle up to several thousand users. For high-load systems, Low-code or classic development is better.

Source: term "No-code platform"

They allow quickly creating digital services without many developers. Critical systems use certified Low-code solutions integrated with SMEV.

Source: term "No-code platform"

No programming knowledge is needed. Understanding of business processes, logical thinking and data skills suffice.

Source: term "No-code platform"

A 3D model is a static image. A digital twin is a dynamic system receiving real-time sensor data and analyzing it.

Source: term "Digital twin"

IoT sensors, CAD/CAE models, ML algorithms, cloud platforms and visualization systems.

Source: term "Digital twin"

Energy, industry, construction (BIM), transport and the public sector (smart cities).

Source: term "Digital twin"

Yes, this is a process digital twin, created from BPMS data and process mining.

Source: term "Digital twin"

It is a complex project requiring sensors, data systems, models and training. Terms range from months to 2-3 years.

Source: term "Digital twin"

It predicts failures, models emergency situations and optimizes operations, improving reliability and reducing risks.

Source: term "Digital twin"

High-quality real-time data, historical data, standardized formats, synchronization under 100 ms and CIPF protection.

Source: term "Digital twin"

The functional approach focuses on departments and hierarchy. The process approach focuses on end-to-end business processes crossing several departments.

Source: term "Process approach"

Identify and document processes, appoint owners, develop KPIs, optimize and automate via BPMS or Low-code platforms.

Source: term "Process approach"

BPMS, Low-code platforms and document flow systems. SINTEZ-M and ELMA 365 are popular in Russia.

Source: term "Process approach"

It allows revising administrative regulations and reducing service delivery times, then automating processes through information systems.

Source: term "Process approach"

BPM, Lean, Six Sigma, Reengineering.

Source: term "Process approach"

The responsible person who manages the process, controls execution and is responsible for results, KPI and improvements.

Source: term "Process approach"

Using KPI: process time, cost, quality and customer satisfaction, measured through BPMS dashboards.

Source: term "Process approach"

IT architecture focuses only on the technical part. Enterprise architecture covers the business part too — strategy, processes and structure.

Source: term "Enterprise architecture (EA)"

TOGAF, Zachman, FEAF. In Russia, requirements for state information systems apply.

Source: term "Enterprise architecture (EA)"

It systematizes information about systems, identifies dependencies on imported software and plans the transition to domestic analogues.

Source: term "Enterprise architecture (EA)"

The Enterprise Architect or an architecture department.

Source: term "Enterprise architecture (EA)"

Business, data, application and technical architecture according to TOGAF.

Source: term "Enterprise architecture (EA)"

Constantly, at least once a year, considering changes in strategy, technology and regulations.

Source: term "Enterprise architecture (EA)"

ARIS, Sparx Enterprise Architect, BizzDesign, LeanIX and Russian analogues.

Source: term "Enterprise architecture (EA)"

Artificial intelligence is smart computer programs that can do what only a person could do before: write texts, draw pictures, translate languages, answer questions. The most famous examples are ChatGPT, Yandex Alisa and neural networks for creating images. About how AI works, read the article Machine learning.

Source: term "Artificial intelligence"

The best free AI depends on your tasks: for texts and ideas — ChatGPT, Claude and DeepSeek (with generous limits); for communication in Russian — GigaChat from Sber; for image generation — Bing Image Creator (15 free generations per day). All these services are available online. About how to choose AI for business, read the article Fintech.

Source: term "Artificial intelligence"

In Russia, it is better to use domestic neural networks that work without a VPN: GigaChat from Sber, Yandex Alisa (YandexGPT) and Shedevrum for creating pictures. Foreign services (ChatGPT, Claude) may be unavailable for users from the Russian Federation. Familiarize yourself with the current legislation. About how to use neural networks in Russia, read the article Import substitution.

Source: term "Artificial intelligence"

The best free neural networks for the phone: ChatGPT (official application), DeepSeek (Chinese chatbot), Shedevrum (image generation from Yandex), GigaChat (from Sber) and Perplexity AI (smart search with sources). All applications are available in Google Play and the App Store. About how mobile AI works, read the article Chatbot.

Source: term "Artificial intelligence"

Artificial intelligence is a general concept of creating "smart" machines. Machine learning is a specific method of creating AI in which the computer learns from data without direct programming. In simple words: AI is the goal, and machine learning is one of the tools for achieving it. Read more about the differences in the article Machine learning.

Source: term "Artificial intelligence"

The main risks of AI: disinformation (neural networks can invent facts), leakage of confidential data, algorithm bias, displacement of jobs and the hypothetical threat of losing control over superintelligence. Never transmit personal passwords, passport data and commercial secrets to AI. About data protection, read the article Digital footprint.

Source: term "Artificial intelligence"

Start by using ready-made AI tools — ChatGPT, Claude, Midjourney. If you want to create your own models, learn Python, linear algebra and probability theory. Free courses are available on Stepik and Coursera. About what skills are needed to work with AI, read the article Machine learning.

Source: term "Artificial intelligence"

Machine learning is a way to teach a computer to find patterns in data without rigid programming. Instead of writing rules for every situation, you give the algorithm thousands of examples, and it learns from them itself. For example, you show it 10,000 photos of cats and dogs, and it learns to distinguish them. Read more about related technologies in the article Artificial intelligence.

Source: term "Machine learning"

Artificial intelligence is a broad concept of creating "smart" machines. Machine learning is a specific method of creating AI in which the computer learns from data. We can say that machine learning is a subfield of AI, its main tool. Not every AI uses machine learning, but almost all modern AI systems are based on ML. Read more about the differences in the article Artificial intelligence.

Source: term "Machine learning"

Examples of ML are everywhere: the spam filter in email, film recommendations on Kinopoisk, voice assistants (Alisa, Siri), face recognition in the phone, weather forecasts, product recommendations in online stores. Banks use ML to assess credit risks and detect fraudulent transactions. About how ML protects banks, read the article Fraud monitoring.

Source: term "Machine learning"

The main language of machine learning is Python. Most neural networks are created in it thanks to a huge number of libraries (PyTorch, TensorFlow, Scikit-learn). R is also used (for statistics), C++ (for high performance) and Java (for corporate systems). For beginners, Python is the best choice thanks to its simplicity and huge community.

Source: term "Machine learning"

The salary of an ML engineer in Russia: Junior — 80,000–150,000 rubles, Middle — 150,000–250,000 rubles, Senior — 300,000–500,000+ rubles per month. In the USA, salaries are significantly higher: Junior — $90,000–$110,000 per year, Senior — $150,000–$250,000+ per year. Income depends on experience, technology stack and industry. About the ML engineer profession, read the article Low-code.

Source: term "Machine learning"

Yes, it is quite possible to learn machine learning on your own. Start with learning Python, the basics of mathematics (linear algebra, probability theory) and libraries (NumPy, Pandas, Scikit-learn). Free courses are available on Stepik and Coursera. Practice on the Kaggle platform with real datasets. The full path from beginner to Junior takes 6–12 months. About where to start, read the article Low-code.

Source: term "Machine learning"

Machine learning is a broad class of methods for finding patterns in data. Neural networks are only one of the machine learning algorithms, inspired by the structure of the human brain. Any neural network is machine learning, but not all machine learning is neural networks. For example, decision trees and linear regression are also ML, but they are not neural networks. Read more about neural networks in the article Artificial intelligence.

Source: term "Machine learning"

A chatbot is a virtual assistant that communicates with you in a chat. It can answer questions, help place orders, book services or simply maintain a conversation. Bots can be simple (button) and smart (AI-based). About how smart bots work, read the article Artificial intelligence.

Source: term "Chatbot"

The danger of chatbots is the leakage of personal data, phishing and account theft. When launched, the bot can see your ID and nickname. If you enter personal data, it can fall into the hands of fraudsters. Always check bots by reviews and do not transmit confidential information. About how to protect yourself from fraudsters, read the article Fraud.

Source: term "Chatbot"

A chatbot can answer questions, help place orders, book services, send notifications, collect contacts and conduct surveys. Depending on the complexity, the bot can understand live speech (using AI) or work only by buttons. About how AI bots work, read the article Artificial intelligence.

Source: term "Chatbot"

The cost of creating a chatbot depends on the complexity: from 0 rubles (independently through a builder) to 500,000+ rubles (turnkey development with AI and integration). Builders cost 1,000–3,000 rubles per month. A simple bot on freelance costs 5,000–50,000 rubles. A complex corporate bot — from 100,000 rubles. Read more about development in the article Low-code.

Source: term "Chatbot"

GPT (Generative Pre-trained Transformer) is artificial intelligence that can understand and generate human text. It is trained on billions of pages of text from the internet. The most famous example is ChatGPT. GPT can write letters, articles, code, translate texts and hold a dialogue. About how language models work, read the article Artificial intelligence.

Source: term "Chatbot"

A bot can be distinguished by unnatural speech, too-fast answers, lack of emotions and misunderstanding of context. Bots often answer in a template manner, repeat phrases or do not catch sarcasm. To check, ask a non-standard question or sharply change the topic. A living person will catch the change of context, while a bot may "get stuck" on the previous question.

Source: term "Chatbot"

A regular chat is communication between two real people. A chatbot is a program that imitates a person. In a regular chat, the interlocutor thinks, makes mistakes and jokes. A chatbot works strictly according to an algorithm or based on AI: it answers faster, but may not understand complex questions and does not catch emotions. Modern AI bots, like ChatGPT, are already very close to humans, but still have limitations. About how AI bots work, read the article Artificial intelligence.

Source: term "Chatbot"

The internet of things is when ordinary things (a kettle, refrigerator, vacuum cleaner, car) connect to the internet and become "smart". They can communicate with each other and with you without your participation. For example, a smart kettle itself turns on the water when you wake up, and a refrigerator reports that the milk has run out. About how this works, read the article Machine learning.

Source: term "Internet of things"

Examples of IoT: smart light bulbs, robot vacuum cleaners, fitness bracelets, smart watches, "smart home" systems, water leak sensors, GPS trackers for cargo, "smart" water and electricity meters, industrial sensors in factories. In agriculture — soil moisture sensors for automatic watering. About the application of IoT in industry, read the article Fintech.

Source: term "Internet of things"

The main risks of IoT are security and privacy. Smart devices collect a lot of data about you: where you live, when you leave home, what habits you have. With weak protection, attackers can hack cameras, locks or other systems. Devices can also stop working without the internet. About how to protect data, read the article Digital footprint.

Source: term "Internet of things"

The internet of things includes: smart light bulbs, thermostats, sockets, locks, cameras, robot vacuum cleaners, smart watches, fitness bracelets, smart meters, GPS trackers, automotive systems, industrial sensors, medical devices (pacemakers, glucometers). In essence, any device with sensors and an internet connection.

Source: term "Internet of things"

IoT (the internet of things) is when physical objects connect to the internet and exchange data. This makes things "smart" — they can make decisions on their own without your participation. For example, a smart home itself regulates the temperature, and a fitness bracelet itself tracks your activity. Read more about the technology in the article Cloud security.

Source: term "Internet of things"

No, IoT and AI are different but complementary technologies. IoT collects data from devices, and AI analyzes this data and makes decisions. Together they create truly "smart" systems. Without AI, IoT simply collects information but does not analyze it. Without IoT, AI will have no data to analyze. About how these technologies work together, read the article Artificial intelligence.

Source: term "Internet of things"

IoT looks like a network of many "smart" devices that communicate with each other through the internet. For example, in a "smart home" these are motion sensors, cameras, thermostats, light bulbs and sockets that are united into a single system. You control them through an application on your phone or by voice. In industry, these are hundreds of sensors on equipment that transmit data to a single server for analysis.

Source: term "Internet of things"

A digital footprint is all the information you leave on the internet. These are your posts on social networks, search queries, likes, purchases, even how much time you spent on the site. If you use the internet, you have a digital footprint. About how to protect your data, read the article Cloud security.

Source: term "Digital footprint"

The digital footprint comes in three types: active (what you publish deliberately — posts, photos, comments), passive (what is collected automatically — search history, cookies, geolocation) and derived (data that algorithms compute on the basis of the first two — your psychological portrait, habits, preferences). Read more about data protection in the article DLP systems.

Source: term "Digital footprint"

The digital footprint is dangerous because it can be used against you. Fraudsters can steal personal data and take out a loan. Employers can see compromising publications and refuse to hire. Algorithms can manipulate your opinion through personalized advertising and news. About how fraudsters use data, read the article Fraud.

Source: term "Digital footprint"

Check yourself in search engines — enter your first name, last name, phone number and nicknames. Use the Have I Been Pwned service to check email leaks. Go to the Cover Your Tracks website to find out which trackers follow you. In Google, go to the "Results about you" page to see what contact data the search engine gives out. About data protection, read the article Incognito mode.

Source: term "Digital footprint"

It is impossible to completely delete a digital footprint — information can be stored in backup copies, archives or databases. But it can be minimized: delete old accounts, restrict the visibility of publications on social networks, use incognito mode, regularly clear cookies. In Russia, the "right to be forgotten" applies — you can hide irrelevant information from search. Read more about privacy settings in the article Incognito mode.

Source: term "Digital footprint"

Your digital footprint is used by companies to personalize advertising and services, employers to check candidates, banks to assess creditworthiness, fraudsters to steal data, and law enforcement agencies for investigations. In essence, anyone who can gain access to your data can use your digital footprint. About data protection in business, read the article Cloud security.

Source: term "Digital footprint"

Use strong passwords and two-factor authentication. Restrict the visibility of publications on social networks. Do not share personal information with strangers. Use incognito mode and ad blockers. Regularly check data leaks through Have I Been Pwned. About how protection tools work, read the article Incognito mode.

Source: term "Digital footprint"

Public procurement is when the state or budget institutions buy goods, works or services from private companies. The entire process is strictly regulated by laws 44-FZ and 223-FZ to ensure transparency and competitiveness. The SKIF-BP system is used to automate procurement activities. The training service will help specialists master working with procurement procedures.

Source: term "Public procurement (44-FZ / 223-FZ)"

To start working in public procurement, you need to register a status (individual entrepreneur, LLC or self-employed), obtain a qualified electronic signature, open a special bank account for trading, register on the Gosuslugi portal and in the Unified Information System (UIS). After that, you can find tenders and submit applications. The SKIF-BP system is used to automate participation. The training service will help master the processes.

Source: term "Public procurement (44-FZ / 223-FZ)"

Legal entities, individual entrepreneurs, as well as individuals and self-employed citizens can participate in public procurement. Organizations in the process of liquidation or bankruptcy, companies with tax debts and offshore companies cannot participate. The SKIF-BP system is used to automate participation in procurement. The training service will help prepare specialists.

Source: term "Public procurement (44-FZ / 223-FZ)"

The official source of all public procurement is the Unified Information System (UIS) in the field of procurement (zakupki.gov.ru). Procurement plans, tenders, contracts and results are published there. Procurement also takes place on electronic trading platforms: Roseltorg, Sberbank-AST, RTS-tender. The SKIF-BP system is used to automate search and participation. The training service will help work effectively with procurement.

Source: term "Public procurement (44-FZ / 223-FZ)"

They make money on public procurement by supplying goods, performing works or providing services to government institutions. The main income is formed by participating in electronic auctions and competitions, where the customer pays for the contract performance. The profit ranges from 10% to 40% of the contract amount. The SKIF-BP system is used to automate participation. The training service will help master tender processes.

Source: term "Public procurement (44-FZ / 223-FZ)"

The amount of contract performance security is set from 0.5% to 30% of the contract amount. Advance security is 100% of the advance amount (if the supplier agreed to receive it). For contracts up to 20 million rubles, the bid security is 0.5-1%, over 20 million — 0.5-5%. The SKIF-BP system is used to manage security. The training service will help understand the procedures.

Source: term "Public procurement (44-FZ / 223-FZ)"

On public procurement, they earn from 10% to 40% of net profit from the contract amount. Supply of goods gives a margin of 10-15%, provision of services and performance of works — from 15% to 40%. Hired tender specialists earn from 40,000 to 120,000 rubles, experienced experts — up to 250,000 rubles. The SKIF-BP system is used to automate participation. The training service will help master tender processes.

Source: term "Public procurement (44-FZ / 223-FZ)"

The GIIS "Electronic Budget" is a state integrated information system for public finance management in Russia. It was developed by the Ministry of Finance and the Federal Treasury to automate the entire financial cycle: from expense planning and public procurement to accounting and reporting. The system unites thousands of budget process participants. Integration with the GIS is provided by the SKIF-BP system. The training service will help employees master working in the system.

Source: term "GIS "Electronic Budget""

The "Electronic Budget" system is created and maintained by the Ministry of Finance of the Russian Federation and the Federal Treasury. All participants of the budget process must work in the system: state and local government bodies, budget and autonomous institutions, commercial organizations participating in state contracts and control bodies. Integration with the SKIF-BP system is used for effective work. The training service will help prepare specialists.

Source: term "GIS "Electronic Budget""

To work in the GIIS "Electronic Budget", you will need to obtain a qualified electronic signature, configure your workstation using CIPF tools (CryptoPro), install certificates and submit an application for connection to the Federal Treasury office. Login is carried out through the Unified Budget System Portal with the selection of an electronic signature certificate. Integration with the SKIF-BP system is used to simplify work. The training service will help master the system.

Source: term "GIS "Electronic Budget""

The "Electronic Budget" was created to automate the planning, execution and control of state and municipal finances. It unites all levels of government in a single digital environment, ensuring transparency and accountability. The system automates budget planning, procurement management, accounting and treasury support. Integration with the GIS is provided by the SKIF-BP system. The design service will help configure integration.

Source: term "GIS "Electronic Budget""

The operators of the GIIS "Electronic Budget" are the Ministry of Finance of the Russian Federation and the Federal Treasury. For the centralized subsystems of the system and the budget.gov.ru portal, the operators are the Russian Ministry of Finance and the Federal Treasury. Integration with the SKIF-BP system is used for effective work with the GIS. The design service will help configure the integration architecture.

Source: term "GIS "Electronic Budget""

Yes, you can log in to the "Electronic Budget" system through Gosuslugi (ESIA), but it depends on the specific subsystem and your access rights. To receive support measures, authorization is possible only through Gosuslugi with a confirmed account and electronic signature. For budget institutions, login via ESIA is provided, but a Treasury certificate is required to sign documents. Integration with the GIS is provided by SKIF-BP. The training service will help configure access.

Source: term "GIS "Electronic Budget""

The full name of the "Electronic Budget" is the State Integrated Information System for Public Finance Management "Electronic Budget" (abbreviated — GIIS "Electronic Budget"). The system was developed for planning and control of budget operations. Integration with the SKIF-BP system is used for effective work with the GIS. The training service will help master working in the system.

Source: term "GIS "Electronic Budget""

Treasury support is strict state control over the spending of budget money. Instead of a regular bank, the state contract executor opens a personal account with the Federal Treasury. Before transferring funds, the Treasury checks exactly what they will be spent on, preventing misuse. The SKIF-BP system automates this process. The training service will help employees master the work.

Source: term "Treasury support"

Treasury support is a form of state control over the targeted spending of budget funds. Contract settlements go through a personal account at the territorial body of the Federal Treasury (UFK), opened and maintained in the GIIS "Electronic Budget". The Treasury checks every payment for compliance with the contract terms. The SKIF-BP system automates treasury support. The design service will help configure the processes.

Source: term "Treasury support"

Treasury support is applied to contracts under 44-FZ worth from 100 million rubles (regardless of the advance), as well as to contracts from 3 million rubles with an advance of more than 50%. For the state defense order — when the transaction amount is more than 300 thousand rubles. For subsidies and national projects, support is mandatory regardless of the amount. The SKIF-BP system helps automate accounting. The training service will help understand the rules.

Source: term "Treasury support"

A contract with treasury support is a contract in which settlements pass through special personal accounts at the Federal Treasury. The contract includes conditions on settlements through a personal account at the UFK, the contractor's obligation to provide information about subcontractors and a ban on transferring funds to bank accounts (except for wages and taxes). The SKIF-BP system automates the support of such contracts.

Source: term "Treasury support"

The disadvantages of treasury support: the complexity of the procedure and high time costs (every action requires approval with government bodies), payment delays (verification takes 1-5 working days), additional document flow. However, this ensures transparency and prevents misuse of budget funds. The SKIF-BP system minimizes these difficulties through automation. The training service will help master the processes.

Source: term "Treasury support"

The goals of treasury support: ensuring targeted use of budget funds, preventing misuse, reducing accounts receivable, increasing the efficiency of budget expenditures, transparency of funds movement and operational control over the execution of state contracts. The SKIF-BP system automates the achievement of these goals. The design service will help configure the system for your tasks.

Source: term "Treasury support"

Yes, you can. Transferring from a treasury (personal) account to a regular bank account is allowed, but strictly regulated. You can transfer funds for actually completed works, reimburse expenses or withdraw net profit after full contract execution. To do this, you need to create a payment order in the "Electronic Budget" system and attach supporting documents. The SKIF-BP system automates this process.

Source: term "Treasury support"

Open APIs (Open Application Programming Interface) are software interfaces that an organization publishes for external use by other developers, companies or government bodies. Unlike internal APIs, they are available outside the organization and allow different systems to exchange data without building individual integrations. In the financial sector, Open APIs are regulated by law: since 2022, the Bank of Russia has been implementing an open API standard for data exchange between banks and third-party financial service providers. Our SINTEZ-M platform provides a built-in Open API designer.

Source: term "Open APIs (Open API)"

Open APIs work through standardized requests to interface endpoints: an external system sends an HTTP request and receives a response in a machine-readable format, such as JSON or XML. The API provider publishes documentation and an API specification, and configures authentication and access rights. This allows external developers and systems to exchange data with the organization without individual integration. In the public sector, open APIs are used for interdepartmental electronic interaction via SMEV and access to government information systems.

Source: term "Open APIs (Open API)"

Open APIs are used in finance — for data exchange between banks and fintech services under the open API standard of the Bank of Russia; in the public sector — for interdepartmental electronic interaction and access to government information systems; and in business — for integrating partners and third-party developers into a digital ecosystem. Depending on the purpose, there are Public APIs (open to any developers), Partner APIs (available to authorized partners under a contract) and Open Government APIs (access to government data and services). Our SINTEZ-M platform allows creating and publishing REST APIs without writing code.

Source: term "Open APIs (Open API)"

Open APIs provide advantages to all parties. For the state: reduced costs for interdepartmental interaction, increased transparency of activities and the creation of an ecosystem of digital services for citizens and businesses. For business: rapid integration with government systems, access to new markets through partner APIs and reduced time to market. For users: a wider range of convenient services based on open interfaces and data.

Source: term "Open APIs (Open API)"

The development of Open API in the public sector is regulated by the Methodological Recommendations of the Ministry of Digital Development, which establish uniform requirements for API formats, protocols and security. For each application, you can automatically generate an OpenAPI specification (Swagger), configure authorization and access management. The SintezM platform supports all Open API requirements, including mandatory authentication through ESIA.

Source: term "Open APIs (Open API)"

An internal API is used only within an organization to connect its own systems, while an Open API is published for external developers, companies or government bodies and is usually regulated by standards and legislation. Open APIs require published documentation, authentication and access management. In the low-code ecosystem, our SINTEZ-M platform provides a built-in Open API designer that allows creating and publishing REST APIs without writing code.

Source: term "Open APIs (Open API)"

Implementation of Open APIs begins with defining an API strategy: deciding which data and functions to expose and whether to use public, partner or government APIs. The interfaces are then designed, documented in an OpenAPI specification (Swagger) and published with authentication and access management configured. Our SINTEZ-M platform includes a built-in Open API designer that automates this process. The design service will help develop the API strategy and architecture.

Source: term "Open APIs (Open API)"

RegTech is a technology that helps companies automatically comply with regulatory requirements (for example, the Bank of Russia, Federal Tax Service). These are programs that independently generate reports, check clients, track suspicious transactions and monitor legal changes. Instead of doing everything manually, companies automate these processes, saving time and reducing the risk of fines. In the public sector, RegTech functionality is implemented in the SKIF-BP system for budget accounting automation. The research service will help identify processes for automation.

Source: term "RegTech (regulatory technology)"

RegTech is a technology for automating compliance with regulatory requirements by companies (bottom-up). SupTech (Supervisory Technology) is the use of technology by regulators (for example, the Bank of Russia) to control the market (top-down). SupTech allows remotely monitoring compliance, detecting violations and analyzing risks across the entire financial system. The SKIF-BP system implements RegTech functionality for government institutions. Read more about the approaches in the technologies section.

Source: term "RegTech (regulatory technology)"

RegTech in Russia is digital technology that helps companies and government institutions automate compliance with regulatory requirements. In Russia, regtech is actively developing within the framework of digital transformation of public administration. Main directions: automation of budget reporting (through SKIF-BP), procurement monitoring under 44-FZ and 223-FZ, control of targeted use of budget funds, as well as KYC and AML for financial organizations. The design service will help implement RegTech solutions in your organization.

Source: term "RegTech (regulatory technology)"

RegTech solves the problems of compliance with regulatory requirements: it automates the preparation of reports for regulators, monitors transactions for signs of financial crimes, manages compliance risks and tracks changes in legislation. This reduces the cost of compliance and the risk of fines. In the public sector, RegTech functionality is implemented in the SKIF-BP system for budget accounting automation. Read more about the approaches in the technologies section.

Source: term "RegTech (regulatory technology)"

RegTech solutions are divided into four main categories: financial risk and capital management (ratio calculation, stress testing); corporate governance, risk and compliance (GRC — Governance, Risk, Compliance); cybersecurity and IT security (incident monitoring, data protection); countering financial crimes (AML, CFT, KYC). In the public sector, RegTech functionality is implemented in the SKIF-BP system for automating budget processes. The research service will help determine priority automation areas.

Source: term "RegTech (regulatory technology)"

The Bank of Russia uses SupTech to collect and analyze reporting data, monitor the compliance of financial organizations with regulations, detect violations and assess risks across the financial system. Automated data collection and machine-readable regulation allow the regulator to respond faster to emerging risks. The SKIF-BP system implements SupTech functionality for state financial control.

Source: term "RegTech (regulatory technology)"

SupTech is used by regulatory and supervisory bodies: central banks, financial market regulators, tax services and state financial control bodies. For example, the Bank of Russia actively uses SupTech tools to monitor the market and collect reports. In the public sector, the SKIF-BP system implements SupTech functionality for state financial control. Read more about the approaches in the technologies section.

Source: term "RegTech (regulatory technology)"

SupTech (Supervisory Technology) is technology used by regulatory bodies to digitalize supervisory activities. These are tools for collecting data, conducting inspections, detecting violations and assessing risks. If RegTech helps companies comply with requirements, then SupTech is a tool of the regulators themselves. In Russia, SupTech is actively used by the Bank of Russia. The SKIF-BP system implements SupTech functionality for state financial control. Read more about the approaches in the technologies section.

Source: term "SupTech (supervisory technology)"

RegTech (regulatory technology) automates compliance with regulatory requirements from the side of supervised organizations — banks, insurers and other market participants. SupTech (supervisory technology) is used by the regulators themselves, for example the Bank of Russia, to collect data, conduct inspections and assess risks. Thus, RegTech works bottom-up, and SupTech works top-down. The SKIF-BP system implements RegTech and SupTech functionality for the public sector.

Source: term "SupTech (supervisory technology)"

SupTech tools include systems for automated collection and analysis of reports, remote monitoring of compliance, machine-readable regulation, stress testing and risk analysis of the entire financial system. These technologies allow regulators to detect violations faster and reduce the burden of inspections on supervised organizations. In Russia, SupTech is actively used by the Bank of Russia. Read more in the technologies section.

Source: term "SupTech (supervisory technology)"

SupTech allows regulators to reduce the costs of collecting and processing data, increase the speed of detecting violations and assess risks across the entire financial system in real time. It also reduces the administrative burden on supervised organizations, since reporting becomes automated. This makes supervision more effective and transparent. The SKIF-BP system implements SupTech functionality for state financial control.

Source: term "SupTech (supervisory technology)"

RegTech and SupTech are two terms describing the application of technology for regulatory compliance and supervision. RegTech (regulatory technology) is a tool of supervised organizations for effective compliance. SupTech (supervisory technology) is a tool of regulators for control and supervision. In Russia, both directions are actively developing, especially in the financial and public sectors. The SKIF-BP system implements RegTech and SupTech functionality. Learn more in the technologies section.

Source: term "SupTech (supervisory technology)"

FinTech (financial technology) is a broad class of technologies that improve financial services: digital banking, payment processing, investment platforms. RegTech (regulatory technology) is a subset of FinTech aimed at helping financial institutions comply with regulatory requirements. RegTech automates reporting, transaction monitoring and risk management. SupTech is the technology of regulators for control. The SKIF-BP system implements RegTech and SupTech functionality for the public sector.

Source: term "SupTech (supervisory technology)"

RegTech is used by financial institutions (banks, insurance companies) to comply with regulatory requirements, manage risks and fight financial crimes. Regulatory bodies use SupTech to control the market. In the public sector, RegTech solutions are used to automate budget accounting and procurement control — these tasks are solved by the SKIF-BP system. The design service will help implement RegTech in your organization.

Source: term "SupTech (supervisory technology)"

The Mir payment system is a Russian national payment system that provides payment operation services and issues bank cards. It was created to ensure the independence of Russia's payment infrastructure from external factors. The operator is NSPK JSC, owned by the Bank of Russia. Mir cards are used for social payments and everyday settlements. The SKIF-BP system supports interaction with NSPK.

Source: term "Mir national payment system"

The Mir payment system belongs to the state. Its operator is the National Payment Card System (NSPK) JSC. 100% of NSPK JSC shares are owned by the Central Bank of the Russian Federation. This guarantees the independence of the system from external factors and state control over the payment infrastructure. The SKIF-BP system is integrated with NSPK for budget payments.

Source: term "Mir national payment system"

The national payment system of Russia is a financial infrastructure for uninterrupted non-cash settlements. The main operator is NSPK JSC. The basis of the system is the national payment card Mir and the Fast Payment System (FPS) from the Bank of Russia, which allows instantly transferring money and paying for goods by phone number or QR code. The SKIF-BP system supports interaction with NSPK.

Source: term "Mir national payment system"

Visa is an international payment system (USA) operating worldwide. Mir is a national payment system of Russia operating within the country and in a limited number of friendly countries. Due to sanctions, Visa cards issued in Russia do not work abroad. Social payments (pensions, benefits) are transferred only to Mir cards. The SKIF-BP system supports the transfer of budget payments to Mir cards.

Source: term "Mir national payment system"

The Mir card is issued by all major Russian banks: SberBank, T-Bank, Alfa-Bank, VTB, Gazprombank, Promsvyazbank, Sovcombank, Rosselkhozbank and others — more than 150 banks in total. The full current list is available on the official website of the Mir payment system. For social payments and budget transfers, the SKIF-BP system integrated with NSPK is used.

Source: term "Mir national payment system"

The Mir national payment system is a Russian non-cash payment system that ensures the independence of the country's payment infrastructure. The operator is NSPK JSC, owned by the Bank of Russia. Mir cards are used for everyday payments, cash withdrawal and receiving social payments. The system supports contactless payment via Mir Pay and QR code transfers. The SKIF-BP system is integrated with NSPK for budget settlements.

Source: term "Mir national payment system"

The Mir payment system is a card-based national payment system: money is moved using Mir bank cards. The Fast Payment System (FPS) is a service of the Bank of Russia for instant transfers by phone number or QR code, which works without cards. Both are operated by the NSPK and complement each other in the Russian payment infrastructure. The SKIF-BP system is integrated with NSPK for budget settlements.

Source: term "Mir national payment system"

More than 300 Russian banks are connected to FPS, including all systemically significant ones: Sberbank, VTB, T-Bank, Alfa-Bank, Gazprombank, Rosselkhozbank, Sovcombank, Promsvyazbank. By law, all banks with a universal license must be connected to FPS. The full list is available on the official FPS website.

Source: term "Fast Payment System (FPS)"

Disadvantages of FPS: no cashback when paying by QR code, irrevocability of transfers (an erroneous payment cannot be cancelled), limits on free transfers (up to 100,000 rubles per month), risk of fraud (instant crediting), technical limitations (you need a smartphone with the internet). For business — the risk of human factor and the complexity of splitting payments.

Source: term "Fast Payment System (FPS)"

Via FPS you can transfer up to 100,000 rubles per month to other people without commission. If exceeded — a commission of 0.5% (maximum 1,500 rubles). Between your own accounts in different banks — up to 30,000,000 rubles per month. The maximum amount of one transfer is 1,000,000 rubles.

Source: term "Fast Payment System (FPS)"

FPS works around the clock and instantly, uses only the phone number (no need to know the card number or details) and allows making transfers without commission (up to the limit). Regular transfers require a card number or full bank details, can take from hours to days and are often subject to a commission. FPS also allows paying for goods by QR code.

Source: term "Fast Payment System (FPS)"

FPS is beneficial for individuals: instant transfers without commission up to the limit, convenience (only a phone number is needed), safety (no need to hand the card to the cashier). For business: savings on acquiring (commission 0.2–0.7% versus 2–3%), instant crediting of revenue, ease of connection (only a QR code is needed).

Source: term "Fast Payment System (FPS)"

Payment via FPS is dangerous due to the irrevocability of transfers — an erroneous payment cannot be cancelled. Fraudsters can force you to transfer money under the guise of a "safe account" or pay for goods by QR code to a personal account. The bank can suspend a suspicious transfer or block the account under Law 115-FZ. It is recommended to verify the recipient before transferring.

Source: term "Fast Payment System (FPS)"

Sber charges a commission for FPS transfers in three cases: the 100,000 ruble monthly limit is exceeded (0.5% commission), a transfer between your own accounts with different phone numbers (the system may consider the recipient another person) and a transfer from a credit card (standard cash withdrawal commission). Limits can be tracked in the mobile application.

Source: term "Fast Payment System (FPS)"

A citizen's digital profile is a set of reliable personal data of a person stored in state information systems (Ministry of Internal Affairs, FNS, Rosreestr, SFR) and combined on the basis of the Gosuslugi portal. It serves for secure and fast identity confirmation when receiving services. Instead of collecting paper certificates, you give the organization temporary access to your data through the interdepartmental electronic interaction system.

Source: term "Digital profile"

A digital profile allows the bank to automatically receive reliable data about the client from state sources. This relieves the client of the need to personally provide documents. Result: reduction of time for identification and product registration (loan, deposit, card). Banks use this information to comply with 152-FZ requirements and combat fraud.

Source: term "Digital profile"

Refusing to use a digital profile is possible: it is enough not to give consent to access your data when organizations request it. A digital profile is a voluntary service that simplifies receiving services, but is not mandatory. You can revoke previously issued consents at any time through the personal account on the Gosuslugi portal, ensuring full control over your personal data.

Source: term "Digital profile"

To create a digital profile, you need to have a confirmed account on the Gosuslugi portal. It is created automatically during registration and identity confirmation (through online banking, MFC or electronic signature). The digital profile itself does not require separate activation — it is formed automatically from data already available in state information systems. To work with the profile, an electronic signature is used to confirm consents.

Source: term "Digital profile"

The citizen's digital profile includes more than 80 types of information: passport data, SNILS, INN, driving license, information about real estate and vehicles, income and work experience data, education information, social benefits and status. Access to this data is strictly controlled and provided only with your consent through the identification and authentication system.

Source: term "Digital profile"

An organization's digital profile (CDP) is a set of current information about a company (LLC, JSC, IE), stored in state information systems and combined on the basis of the Gosuslugi infrastructure. It eliminates the need to manually collect and provide certificates, speeding up interaction with banks and government bodies. Access to the profile is carried out through the legal entity's personal account on Gosuslugi.

Source: term "Digital profile"

You can confirm income through a digital profile via the Gosuslugi portal or the taxpayer's personal account. In the "Income" section you can get a 2-NDFL certificate in electronic form, which is certified by an electronic signature and has legal force. This eliminates the need to visit the tax inspectorate. To access this data, authentication via ESIA is used.

Source: term "Digital profile"

Digital transformation of the public sector is the comprehensive introduction of digital technologies into the activities of government bodies to improve the quality of management and public services. In the Russian Federation it is implemented within the framework of the national program "Digital Economy" and the federal project "Digital Government". It covers the transfer of services to electronic form, automation of internal processes and data-driven management. Our SINTEZ-M low-code platform is used to build such solutions.

Source: term "Digital transformation of the public sector"

Digital transformation of the public sector works through five key directions: automation of internal processes, transfer of public services to electronic form, development of channels of interaction with citizens, use of data for decision-making and ensuring information security. Each direction is implemented as concrete projects with measurable indicators. The design service will help plan such projects.

Source: term "Digital transformation of the public sector"

Digital transformation of the public sector is applied at all levels of government — federal, regional and municipal. It covers public services delivered through the Gosuslugi portal, budget processes, interdepartmental electronic interaction, healthcare, education and social protection. The goal is to make services faster and more convenient for citizens and businesses.

Source: term "Digital transformation of the public sector"

Digital transformation provides tangible advantages: faster delivery of public services, reduced bureaucracy and fewer opportunities for corruption, transparency of government bodies and lower administration costs. Data-driven management allows making management decisions based on analysis of large volumes of data. This improves the quality of interaction between the state, citizens and businesses.

Source: term "Digital transformation of the public sector"

The requirements for digital transformation are set by the national program "Digital Economy" and the federal project "Digital Government". Each government body must appoint a digital transformation leader (CDO), achieve target indicators of digital maturity and transfer priority services to electronic form. The mandatory use of domestic software also applies within the framework of import substitution. Our SINTEZ-M platform helps meet these requirements.

Source: term "Digital transformation of the public sector"

Digital transformation in business is aimed at increasing profit and competitiveness, while in the public sector it is aimed at the quality and accessibility of public services for citizens. Public sector projects are more strictly regulated: they are carried out within national programs, require the achievement of target indicators of digital maturity and are subject to import substitution requirements. They also place higher demands on information security.

Source: term "Digital transformation of the public sector"

Implementation begins with an assessment of the current level of digital maturity and the appointment of a digital transformation leader (CDO). A roadmap is then developed: priority services are transferred to electronic form, internal processes are automated and a data management system is introduced. Employee training and information security are also important elements. The design service will help plan the implementation.

Source: term "Digital transformation of the public sector"

Payment orders, letters of credit, collection (incasso), checks and payments via the FPS. RBS systems are used by business.

Source: term "Non-cash payment"

In cash settlement money is transferred physically. In non-cash settlement funds are transferred between bank accounts. Non-cash is more transparent and controlled.

Source: term "Non-cash payment"

A payment order, invoice, works acceptance certificate or delivery note. An electronic receipt is issued for FPS payments.

Source: term "Non-cash payment"

All settlements pass through Federal Treasury accounts. The Electronic Budget GIS and treasury support are used.

Source: term "Non-cash payment"

In the Fast Payment System the transfer is instant by phone or QR code, with no commission up to a limit.

Source: term "Non-cash payment"

Using CIPF, multi-factor authentication, fraud monitoring and staff training.

Source: term "Non-cash payment"

Simplified tax accounting, reduced risks, automated settlements and faster transactions via RBS systems.

Source: term "Non-cash payment"

RBS (remote banking services) is the ability to manage accounts without visiting a branch via internet banking, a mobile app or SMS, including transfers via the FPS.

Source: term "Remote banking services (RBS)"

Transfers, payment for goods and services, opening deposits, obtaining loans, currency exchange, card blocking. Payroll projects for business.

Source: term "Remote banking services (RBS)"

Modern RBS uses multi-factor authentication, TLS encryption and fraud monitoring. CIPF is used for legally significant operations.

Source: term "Remote banking services (RBS)"

Open an account, sign an RBS contract, obtain electronic signature keys and install a client-bank.

Source: term "Remote banking services (RBS)"

In some banks RBS denotes the Bank Service Agreement — the basic document regulating all terms of cooperation with the bank.

Source: term "Remote banking services (RBS)"

Biometric authentication, artificial intelligence, open APIs, the digital ruble, chatbots.

Source: term "Remote banking services (RBS)"

Certified CIPF, integration with ESIA, SMEV, Electronic Budget, and compliance with 187-FZ for CII.

Source: term "Remote banking services (RBS)"

KYC is a procedure in which a bank verifies who you are and where your money comes from. OCR recognition and biometric identification are used.

Source: term "Know Your Customer (KYC)"

A passport, INN, SNILS and address confirmation. For legal entities — constituent documents and beneficiary data.

Source: term "Know Your Customer (KYC)"

Basic KYC takes 5-15 minutes. Standard verification 1-3 business days. Enhanced (EDD) up to 2 weeks.

Source: term "Know Your Customer (KYC)"

You will not be able to open an account or use financial services. The bank may block an existing account.

Source: term "Know Your Customer (KYC)"

KYC is client identification. AML is a broader system that includes KYC, transaction monitoring and interaction with regulators (115-FZ).

Source: term "Know Your Customer (KYC)"

OCR, MRZ recognition and biometric identification reduce the procedure to 5-15 minutes.

Source: term "Know Your Customer (KYC)"

Stricter requirements, remote identification via ESIA and biometrics, AI-based risk assessment systems.

Source: term "Know Your Customer (KYC)"

Banking secrecy is a legal obligation of banks and other financial organizations to keep secret all information about their clients: their personal data, account status, amounts and recipients of transfers. This protects your finances and personal life from prying eyes.

Source: term "Banking secrecy"

Banking secrecy includes the client's passport data, information about accounts and deposits (their numbers, opening dates, currency), balances, details of all operations (transfers, withdrawals, deposits), as well as information about income and assets if it became known to the bank. The bank is not entitled to disclose these data without the client's consent.

Source: term "Banking secrecy"

The bank is obliged to disclose information about a client only upon an official request from authorized state bodies: courts, the tax service, bailiffs, the police, customs and some others. Data are also transferred to credit history bureaus to form a credit rating. In all other cases, disclosure of information is illegal.

Source: term "Banking secrecy"

Banking secrecy protects information about the bank's clients, while commercial secrecy protects the company's own secrets (technologies, strategies, client bases). Banking secrecy is strictly established by law, while a company determines commercial secrecy itself. At the same time, the bank uses both regimes simultaneously: banking secrecy for depositor data, commercial secrecy for its own internal developments.

Source: term "Banking secrecy"

Serious liability, up to criminal liability under Article 183 of the Criminal Code of the Russian Federation, is provided for disclosing banking secrecy. This can be a fine of up to 500,000 rubles, corrective labor or imprisonment for up to two years. The guilty parties can also be held to disciplinary, civil or administrative liability.

Source: term "Banking secrecy"

Not only the banks themselves, but also audit organizations, the Central Bank of the Russian Federation, deposit insurance organizations, as well as their employees are obliged to maintain banking secrecy. They must keep secret information about the operations, accounts and deposits of clients and correspondents.

Source: term "Banking secrecy"

Banking secrecy is protected at the level of laws — the Civil Code of the Russian Federation (Art. 857) and the Law "On Banks and Banking Activity" (Art. 26). These acts determine which information is secret, to whom it can be disclosed, and what liability violators bear. In the event of a data leak, the client can demand compensation through court.

For additional protection of confidential information in electronic document workflow, our solutions — SINTeZ-M and SKIF-BP — provide reliable encryption and access control.

Source: term "Banking secrecy"

Cyber fraud is deception on the internet when attackers use digital technologies to steal your money or personal data. They can call you on behalf of the bank, create a fake website or hack a friend's account on social networks. The main goal is to make you voluntarily transfer money or disclose passwords. Read more about how protection systems work in the article on fraud monitoring.

Source: term "Cyber fraud"

The most frequent schemes: calls from the "bank security service" demanding a transfer of money to a "safe account", phishing (fake websites of banks and stores), hijacking accounts on social networks to ask for money, investment scams with a guaranteed income, and deepfakes — faking the voice or video of relatives/management with a request for an urgent transfer. Learn how to recognize these schemes in our information security section.

Source: term "Cyber fraud"

Fraudsters use pressure and urgency: "your money is being stolen", "take out a loan to transfer it to a safe account". They demand immediate action and do not give time to think or consult. Real bank and state employees never request SMS codes, the card CVV code or ask to transfer money to other accounts. SINTeZ-M — our solution for secure document workflow — will help protect your data.

Source: term "Cyber fraud"

Immediately block the card through the mobile application or the bank hotline. Collect all evidence: screenshots of correspondence, transfer receipts, links to websites. Contact the police with a fraud report. Also file a chargeback (payment return) application with your bank if the payment was made by card. A more detailed instruction is in the Questions and answers section.

Source: term "Cyber fraud"

Criminal liability for cyber fraud in Russia is provided under Article 159.6 of the Criminal Code of the Russian Federation. For damage up to 250,000 rubles — up to 3 years of imprisonment. For major damage (from 250,000 rubles) — up to 5 years. For especially large scale (from 1 million rubles) or by an organized group — up to 10 years of imprisonment. The criminals are also obliged to compensate the damage to the victims. Read more about the legal aspects in the article on electronic signature.

Source: term "Cyber fraud"

Use strong passwords and enable two-factor authentication (2FA) for all accounts. Never disclose SMS codes and the card CVV code to anyone. Check website addresses before entering data. If someone calls from a "bank" — hang up and call back on the official number. Regularly check your credit history through Gosuslugi to notice foreign loans.

For additional protection of your data in electronic document workflow, use SINTeZ-M and SKIF-BP — they provide reliable encryption and secure document transfer.

Source: term "Cyber fraud"

If you paid for goods but the seller disappeared, contact your bank with a request for payment return (chargeback). Also file a report with the police and file a complaint about the fraudulent website with Roskomnadzor so that it is blocked. Leave a review on themed forums — this will help other users avoid falling for the scheme. About how to protect your business from fraudsters, read the article on attestation testing.

Source: term "Cyber fraud"

Fraud is any type of deception committed on the internet. It can be the theft of money from a bank card, a fake website that extracts passwords, or click inflation in advertising by bots. The main goal of fraud is to deceive the system and obtain illegal benefit. Anti-fraud systems are used for protection, as described in detail in the article Fraud monitoring.

Source: term "Fraud"

The main types of fraud: banking (theft of money from cards, phishing), advertising (click inflation by bots), e-commerce (purchases on stolen cards, multi-accounting), corporate (employee fraud) and cryptocurrency (scam projects, phishing wallets). About protection from corporate fraud, read the article DLP systems.

Source: term "Fraud"

Fraud and scam are practically synonyms. Both terms mean fraud. The difference is that fraud is more often used in the banking sphere and corporate security, while scam is used in the internet space (phishing sites, fake investment projects, fake lotteries). In essence, scam is one of the types of fraud.

Source: term "Fraud"

Anti-fraud systems analyze user behavior in real time. They check geolocation, the device, typing speed, transaction history. If the system notices something unusual — for example, logging in from a new device at 3 a.m. — the operation is blocked. Read more about the operating principles in the article Fraud monitoring.

Source: term "Fraud"

Criminal liability for fraud in Russia is provided under Article 159 of the Criminal Code of the Russian Federation. If the damage is up to 2,500 rubles, it is an administrative violation. From 2,500 rubles — up to 2 years of imprisonment. From 250,000 rubles — up to 5 years. From 1,000,000 rubles — up to 10 years. For cyber fraud, Article 159.6 of the Criminal Code applies.

Source: term "Fraud"

An integrated approach is required to protect a business from fraud: implementing anti-fraud systems, training employees in cybersecurity rules, using multi-factor authentication and data encryption. Regular information security audit will help identify vulnerabilities before fraudsters use them. For secure document workflow, use SINTeZ-M, and for data encryption — SKIF-BP.

Source: term "Fraud"

Ad fraud is the inflation of advertising impressions and clicks using bots. The advertiser pays for non-existent users, and the budget is wasted. Signs of ad fraud: abnormal traffic spikes at night, high CTR with zero sales, identical IP addresses. Anti-fraud systems that filter out bots help combat this.

Source: term "Fraud"

Fraud monitoring is a system that monitors your financial operations and blocks suspicious transactions. For example, if you usually buy groceries in a supermarket, and the system sees an attempt to withdraw a large amount in another country — the operation is blocked. This protects your money from fraudsters. Read more about types of fraud in the article Fraud.

Source: term "Fraud monitoring"

The system analyzes hundreds of parameters: geolocation, device, operation time, transaction history. First it creates a digital profile of your usual behavior. If something unusual happens — for example, a login from a new device at night — the operation is blocked or sent for confirmation. About how systems use machine learning, read the article Machine learning.

Source: term "Fraud monitoring"

Fraud monitoring protects business from financial losses, increases client trust and helps comply with the requirements of regulators, including 152-FZ. The system automatically blocks fraudulent operations, reducing the load on the security service and minimizing losses.

Source: term "Fraud monitoring"

A fraud monitoring specialist analyzes suspicious operations, configures system rules, develops risk models and investigates incidents. He works with big data, uses machine learning and interacts with other departments — the security service, the legal department and IT. About the profession of a security specialist, read the article SOC.

Source: term "Fraud monitoring"

An antivirus protects your device from malicious programs, while fraud monitoring protects your financial operations from fraudsters. The antivirus works on the local device, fraud monitoring — on the servers of the bank or payment system. Together they provide comprehensive protection: the antivirus from viruses, fraud monitoring from financial losses.

Source: term "Fraud monitoring"

When choosing a system, pay attention to scalability, analysis speed, the use of AI and ML, the possibility of integration with the existing infrastructure and the availability of detailed reporting. The optimal solution depends on the volume of transactions and the specifics of your business. To select a solution, contact experts — for example, conduct an information security audit.

Source: term "Fraud monitoring"

Such cases are rare but possible. If an operation is blocked, you will receive a notification. You can confirm the operation by responding to the SMS or a call from the bank, or contact the support service. Modern systems based on machine learning constantly reduce the number of false positives. About how such systems work, read the article Artificial intelligence.

Source: term "Fraud monitoring"

Bitcoin is digital money that is not controlled by banks and states. It exists only on the internet, and its quantity is strictly limited — only 21 million coins. Bitcoin allows you to transfer money to anyone and anywhere without intermediaries, fees and account freezes. Read more about blockchain technology in the article Cryptocurrency.

Source: term "Bitcoin"

The bitcoin exchange rate constantly changes. Today 1 BTC costs approximately $59,000–$60,500 (about 4,650,000–4,750,000 rubles). You can see the exact figure for the current moment on exchanges like Binance or Kraken, as well as on aggregators like CoinMarketCap. The price depends on supply and demand on the market.

Source: term "Bitcoin"

You can buy bitcoin in Russia in several ways: through crypto exchanges (Bybit, OKX), P2P platforms (transactions between users), online exchangers or offline offices. To buy, you will need a bank card or cash. About how to secure your crypto assets, read the article CIPF.

Source: term "Bitcoin"

Yes, bitcoins can be exchanged for rubles, dollars or euros. For this, use crypto exchanges (Binance, Bybit), P2P platforms or online exchangers. The fastest way is P2P trading, where you sell bitcoin directly to another person and receive money on a bank card.

Source: term "Bitcoin"

For 1000 rubles you can buy approximately 0.00021–0.00022 BTC, since 1 bitcoin costs about 4.6–4.7 million rubles. The exact amount depends on the current exchange rate. To buy such a small amount, it is convenient to use P2P platforms or online exchangers that work with small transactions.

Source: term "Bitcoin"

Bitcoin can crash due to strict regulation, network vulnerabilities or mass selling by large investors. However, complete devaluation is unlikely, since bitcoin has a strong community and institutional investors. In the event of a market collapse, many investors use the dollar-cost averaging (DCA) strategy, buying the asset on the decline. Read about investment strategies in the article Cryptocurrency.

Source: term "Bitcoin"

Elon Musk does not publicly disclose the exact amount of his personal crypto assets. However, his companies hold significant reserves: Tesla — about 11,509 BTC, SpaceX — about 8,285 BTC. Also, according to his father, Elon and his brother Kimbal may own about 23,400 BTC together. The current status of corporate reserves can be tracked on the Bitcoin Treasuries platform.

Source: term "Bitcoin"

Cryptocurrency is digital money that is not controlled by banks and states. It exists only on the internet, is protected by cryptography and often has a limited quantity. Bitcoin is the most famous cryptocurrency, but there are thousands of others: Ethereum, Tether, Solana. Read more about bitcoin in the article Bitcoin.

Source: term "Cryptocurrency"

Cryptocurrencies are divided into several types: coins (Bitcoin, Ethereum), altcoins (Solana, Cardano), stablecoins (USDT, USDC, pegged to the dollar) and tokens (utility or unique NFTs). Each type performs its own function. About how tokens differ from coins, read the article Token.

Source: term "Cryptocurrency"

Yes, you can really earn real money on cryptocurrency, but it is a high-risk market. Ways to earn: long-term investing (HODL), active trading, staking (passive income) and participation in new projects (AirDrop). The return is directly proportional to the risks — you can both multiply your capital and lose it completely. About investment strategies, read the article Fintech.

Source: term "Cryptocurrency"

The most popular cryptocurrencies by capitalization: Bitcoin (BTC) — the first and most famous, Ethereum (ETH) — a platform for smart contracts, Tether (USDT) — the most popular stablecoin pegged to the dollar. The top also includes Solana (SOL), Binance Coin (BNB) and XRP. Read more about bitcoin in the article Bitcoin.

Source: term "Cryptocurrency"

You can buy cryptocurrency in Russia through crypto exchanges (Bybit, OKX), P2P platforms (transactions between users), online exchangers or offline offices. To buy, you will need a bank card. Please note: cryptocurrency cannot be used as a means of payment within the country; the ruble remains the only legal tender.

Source: term "Cryptocurrency"

The safest way to store large amounts of cryptocurrency is cold wallets — hardware devices (Ledger, Trezor) that store keys offline. For small amounts and active trading, hot wallets on exchanges are suitable, but they are less secure. Never store recovery phrases and private keys online or share them with third parties.

Source: term "Cryptocurrency"

A coin is a base asset with its own independent blockchain (Bitcoin, Ethereum). A token is created on top of an existing blockchain, most often Ethereum, and can perform various functions: access to platform services (utility tokens), representation of shares in real assets (security tokens) or confirmation of ownership rights (NFT).

Source: term "Cryptocurrency"

A token is a digital unit created on the basis of an existing blockchain. It is like special coupons or tickets inside a project's ecosystem. Tokens can be a currency, shares, access keys or confirmation of ownership. Unlike coins (Bitcoin, Ethereum), tokens do not have their own blockchain. Read about what cryptocurrency is in the article Cryptocurrency.

Source: term "Token"

A coin (Bitcoin, Ethereum) has its own blockchain and is used to pay fees in its network. A token does not have its own blockchain and is created on the basis of someone else's (for example, on Ethereum). In simple terms: a coin is your own currency in your own country, a token is special coupons inside that country. Read about bitcoin in the article Bitcoin.

Source: term "Token"

The main types: utility tokens (give access to services), security tokens (digital shares), governance tokens (vote rights), NFT (unique tokens for art or collectibles) and stablecoins (pegged to the dollar). Each type performs its own function. Read about cryptocurrencies in the article Cryptocurrency.

Source: term "Token"

The cost of a token depends on its type and market situation. Stablecoins (USDT, USDC) always cost about $1. Utility and governance tokens can cost from fractions of a cent to thousands of dollars — their price is determined by supply and demand on the market. The rate of a specific token can be seen on exchanges like Binance or CoinGecko.

Source: term "Token"

You can create a token without programming in a few minutes through special generator platforms (CreateMyToken, Smithii). You need to connect a crypto wallet (MetaMask), pay the network fee and fill in the name, ticker and number of tokens. For complex tokens with additional functions, a smart contract programmer is required. Read about creating crypto projects in the article Cryptocurrency.

Source: term "Token"

NFT (Non-Fungible Token) is a unique token that cannot be exchanged for another one-to-one. Regular tokens (USDT, UNI) are fungible — one dollar equals another dollar. NFTs are unique — each unit has its own characteristics and value. NFTs are used to confirm ownership of digital art, collectible items and game items.

Source: term "Token"

Buying tokens involves high risks. Many tokens are fraudulent projects (scams) that can disappear with investors' money. Even legitimate tokens can fall sharply in price due to market volatility. Invest only those funds whose loss will not be critical for you, and thoroughly study projects before buying. Read about protection from fraudsters in the article Fraud.

Source: term "Token"

Cryptanalysis is the science of how to break ciphers without a key. If cryptography creates locks to protect data, then cryptanalysis tries to find master keys for them. Cryptanalysts look for vulnerabilities in encryption algorithms to make security systems more reliable. Read about how encryption works in the article Data encryption.

Source: term "Cryptanalysis"

Cryptography is the science of protecting data with encryption. Cryptanalysis is the science of breaking ciphers. They are like two sides of the same coin: cryptographers create locks, cryptanalysts check how reliable they are. Without cryptanalysis, cryptography could not develop — knowing vulnerabilities allows fixing them. Read about data protection methods in the article Cryptographic information protection.

Source: term "Cryptanalysis"

The main methods: ciphertext-only attack (there is only encrypted data), known-plaintext attack (there are plaintext-encrypted pairs), chosen-plaintext attack (you can encrypt your own data), linear and differential cryptanalysis (statistical methods for block ciphers). Each method is suitable for different types of ciphers. Read about how algorithms work in the article Data encryption.

Source: term "Cryptanalysis"

Cryptanalysts are specialists who break ciphers and look for vulnerabilities in security systems. They work in cybersecurity companies, government agencies and research centers. Read about professions in IT security in the article Information security.

Source: term "Cryptanalysis"

Modern ciphers (AES-256, RSA-2048) are considered cryptographically strong — they cannot be broken in a reasonable time even using the most powerful computers. However, theoretical vulnerabilities may exist, and cryptanalysts constantly look for them. The emergence of quantum computers could change the situation — they are capable of breaking RSA and ECC in a few hours. Read about cryptographic strength in the article Data encryption.

Source: term "Cryptanalysis"

Linear cryptanalysis is a method of breaking block ciphers based on finding linear dependencies between input and output data. The analyst builds mathematical approximations that relate plaintext, ciphertext and key with high probability. It is especially effective against the DES cipher. This method was developed in 1993 by Japanese cryptographer Mitsuru Matsui. Read about block ciphers in the article Data encryption.

Source: term "Cryptanalysis"

The foundations of cryptanalysis were laid by the Arab mathematician Al-Kindi in the 9th century. He invented the method of frequency analysis — counting the frequency of letters in a text for decryption. This method remained the main way of breaking ciphers for a thousand years until more complex encryption algorithms appeared. Read about the history of cryptography in the article Electronic signature.

Source: term "Cryptanalysis"

A key pair is two keys: a public and a private one. The public key can be given to everyone — messages for you are encrypted with it. The private key is kept secret — you decrypt messages and sign documents with it. It is like a mailbox: the public key is the address of the box, the private key is your personal key to it. Read about how encryption works in the article Data encryption.

Source: term "Key pair"

The public key can be freely distributed — data is encrypted with it. The private key must be kept secret — data is decrypted and digital signatures are created with it. Losing the private key means losing access to all protected information. Read about key storage in the article Certification authority.

Source: term "Key pair"

A key pair is used in electronic signatures for confirming documents, in SSL/TLS for secure websites (HTTPS), in SSH for secure access to servers and in cryptocurrencies for confirming transactions. It is the foundation of all modern digital security. Read about its application in documents in the article Electronic signature.

Source: term "Key pair"

A key pair can be created using specialized software (OpenSSL, CryptoPro CSP) or through a certification authority when obtaining an electronic signature. Generation algorithms: RSA, ECC, GOST R 34.10. To protect it, the private key is written to a secure medium (token) and protected with a PIN code. Read about creating keys in the article Cryptographic information protection.

Source: term "Key pair"

Losing the private key means losing access to all information encrypted with it and the inability to create digital signatures. The private key cannot be recovered — it needs to be reissued through a certification authority. Therefore, private keys are stored on secure media and backup copies are made. Read about key protection in the article Certification authority.

Source: term "Key pair"

Rutoken is a physical medium (token) for storing the key pair of an electronic signature. The private key is stored on the token and never leaves it, which ensures maximum security. Using the key requires entering a PIN code. Rutoken is used for signing documents, reporting and participating in procurement. Read about electronic signatures in the article Electronic signature.

Source: term "Key pair"

Storing the private key on a computer is not recommended due to the risk of infection with viruses and malware that can steal the key. To store private keys, secure hardware media are used — tokens (Rutoken, eToken) or smart cards. They isolate the key from the operating system and require physical access to use. Read about data security in the article Digital footprint.

Source: term "Key pair"

The most reliable way to store cryptocurrency is hardware (cold) wallets — Ledger and Trezor. They store private keys offline, isolating your assets from hackers, viruses and phishing sites. For long-term storage of large amounts this is the best choice. However, even a hardware wallet will not protect you from losing the seed phrase, so keep it in a reliable place.

Source: term "Crypto wallet"

For beginners and regular transfers — Trust Wallet (mobile) or MetaMask (browser extension). For maximum security of large amounts — hardware devices Ledger or Trezor. For active trading — wallets on Bybit or OKX exchanges. The choice depends on your goals and the volume of operations. Read about working with cryptocurrencies in the article Cryptocurrency.

Source: term "Crypto wallet"

You can withdraw money through P2P platforms (Binance P2P, Bybit P2P), online exchangers (BestChange) or cryptocurrency exchanges with a card withdrawal function. The most popular way is P2P trading, where you sell cryptocurrency to another user, and he transfers rubles to your card via SBP or bank transfer. Read about withdrawal methods in the article Payment gateway.

Source: term "Crypto wallet"

Opening a software wallet (Trust Wallet, MetaMask) is completely free. Hardware wallets (Ledger, Trezor) cost from $60 to $150 depending on the model. Exchange wallets are also free, but exchanges charge a fee for withdrawing funds and may charge for inactivity. Read about fees in the article Cryptocurrency.

Source: term "Crypto wallet"

Yes, you can, and it happens more often than you think. If a user loses the physical device (cold wallet) and has not saved a backup of the seed phrase (a sequence of 12 or 24 words for recovery), access to the cryptocurrency is lost forever. You can also lose funds if the seed phrase is compromised (stolen, photographed, entered on a phishing site). Therefore, it is important to store the seed phrase in a reliable place separate from the wallet.

Source: term "Crypto wallet"

A non-custodial wallet is a wallet where you fully control your private keys. Only you have access to the funds, and no one can block or freeze them. Examples: Trust Wallet, MetaMask. A custodial wallet is a wallet on an exchange or with a third-party service, where the keys are stored by the provider. You trust your funds to a third party that can restrict access or be hacked. For long-term storage, non-custodial wallets are recommended.

Source: term "Crypto wallet"

Main protection measures: use a hardware wallet for large amounts, never store the seed phrase in digital form (only on paper in a safe), enable two-factor authentication (2FA) for all exchange accounts, use antivirus software on devices, check recipient addresses before sending a transaction (especially when copy-pasting, as there are viruses that substitute addresses). Read about the security of crypto assets in the article Information security.

Source: term "Crypto wallet"

A smart contract is a self-executing program in the blockchain that automatically fulfills the terms of a deal. It is like a digital vending machine: if the condition is met (for example, you transferred money), the contract automatically executes the action (transfers the goods or service). Without intermediaries and bureaucracy. Read about blockchain technology in the article Blockchain.

Source: term "Smart contract"

To create a smart contract, you need to choose a blockchain (for example, Ethereum), write code in Solidity (or another language for the chosen blockchain), compile it and deploy it in the network. For simple contracts, the online environment Remix IDE is used. You need to pay a network fee (gas) for publishing the contract. Read about development in the article Open source software.

Source: term "Smart contract"

A regular address in the blockchain is just a wallet for storing and sending funds, controlled by a private key. A smart contract is a program that is stored at its own address and can automatically perform actions upon receiving a transaction. A smart contract has its own address, like a wallet, but it is controlled by code, not by a person. Read about working with wallets in the article Crypto wallet.

Source: term "Smart contract"

No, after deployment in the blockchain, a smart contract cannot be canceled or changed (unless the developer provided an update mechanism in advance). This is one of the key properties of the blockchain — immutability. Therefore, before publishing a contract, its code must be carefully checked, tested and undergo a security audit. Read about security risks in the article Information security incident.

Source: term "Smart contract"

Currently, Ethereum is the most popular and mature platform for smart contracts. Binance Smart Chain (BSC), Solana, Tron, Polygon, Avalanche and other blockchains are also actively used. The choice depends on fees (gas), transaction speed, available development tools and the required functionality. Read about cryptocurrencies in the article Cryptocurrency.

Source: term "Smart contract"

A smart contract audit is a check of its code for vulnerabilities, errors and logical problems by professional companies (CertiK, Hacken, Trail of Bits, OpenZeppelin). An audit is necessary to identify potential problems before deploying the contract, in order to avoid the theft of funds or incorrect operation. Without an audit, using a smart contract is extremely risky.

Source: term "Smart contract"

Gas is a unit of measurement of the computing resources needed to perform an operation in a smart contract. Each operation (read, write, computation) requires a certain amount of gas. Users pay for gas in the cryptocurrency of the network (for example, ETH in Ethereum). The cost of gas depends on the complexity of the operation and the load of the network. Under high load, fees can increase significantly.

Source: term "Smart contract"

DeFi is a financial system that works without banks and intermediaries. All operations (loans, deposits, currency exchange) are performed automatically using smart contracts in the blockchain. You fully control your money through private keys. Read about blockchain technology in the article Blockchain.

Source: term "Decentralized finance (DeFi)"

The main directions of DeFi: decentralized exchanges (DEX) for exchanging cryptocurrencies, crypto lending for issuing and receiving loans, staking and yield farming for receiving rewards for locking assets, as well as stablecoins for stable payments. Read about cryptocurrencies in the article Cryptocurrency.

Source: term "Decentralized finance (DeFi)"

DeFi is associated with high risks. For beginners, it is safer to start with well-known and tested protocols (Aave, Uniswap, Compound), use small amounts and carefully study the fees. It is also important to keep funds in a reliable non-custodial wallet. Read about security in the article Information security incident.

Source: term "Decentralized finance (DeFi)"

In traditional banks, your money is stored in accounts controlled by the bank. The bank can freeze the account, restrict operations or charge fees. In DeFi, you fully control your funds through private keys. There are no intermediaries, no bureaucracy, but also no deposit insurance and support service. Read about the comparison in the article Blockchain.

Source: term "Decentralized finance (DeFi)"

The most popular DeFi protocols: Uniswap and PancakeSwap (decentralized exchanges), Aave and Compound (lending), Lido (staking), MakerDAO (issuance of the DAI stablecoin). The choice of platform depends on the network (Ethereum, BSC, Solana, Polygon) and your goals. Read about cryptocurrencies in the article Cryptocurrency.

Source: term "Decentralized finance (DeFi)"

Impermanent loss is a temporary loss of value when providing liquidity to DEX pools. It arises when the price of one of the tokens in the pair changes compared to the moment of depositing funds. Losses become permanent (realized) only when funds are withdrawn from the pool. The more the price has changed, the greater the loss. This risk is especially relevant in high market volatility.

Source: term "Decentralized finance (DeFi)"

In Russia, DeFi protocols are formally not prohibited, but they do not have a clear legal status. According to Federal Law 259-FZ “On Digital Financial Assets”, cryptocurrencies are recognized as property, but their use for settlements is limited. DeFi platforms are not regulated by the Bank of Russia. It is recommended to monitor changes in legislation and consult lawyers on taxation issues.

Source: term "Decentralized finance (DeFi)"

A cryptographic protocol is a set of rules by which computers securely exchange data. It defines how to encrypt information, verify each other and make sure that the data was not forged. It is like a secret language on which two parties agree. Examples: HTTPS (TLS), SSH, VPN (IPsec). Read about encryption in the article Data encryption.

Source: term "Cryptographic protocol"

The most popular cryptographic protocols: TLS/SSL (protection of websites and HTTPS), SSH (remote server management), IPsec (VPN), PGP/GPG (email encryption), Kerberos (authentication in corporate networks). Each solves its own security tasks. Read about connection protection in the article VPN.

Source: term "Cryptographic protocol"

TLS (Transport Layer Security) is a cryptographic protocol that ensures secure data transmission on the internet. It is used in HTTPS (the padlock in the browser), protects email, messengers and other applications. TLS replaced the outdated SSL. The modern version is TLS 1.3 (2018), which is significantly faster and more secure than previous versions. Read about connection security in the article Data encryption.

Source: term "Cryptographic protocol"

Encryption is a mathematical algorithm for transforming data (for example, AES, RSA). A protocol is a set of rules that determine how to use these algorithms, when and in what sequence. The protocol manages the process, encryption is a tool inside this process. For example, TLS is a protocol that uses AES algorithms for encryption and RSA for key exchange. Read about keys in the article Key pair.

Source: term "Cryptographic protocol"

This is a protocol that ensures the security of data transmission over the network. It protects information from interception, forgery and unauthorized access. Examples: TLS, SSH, IPsec. Cryptographic network protocols are used in corporate networks, the internet, mobile communications and secure government systems. Read about network protection in the article Firewall.

Source: term "Cryptographic protocol"

The main threats: man-in-the-middle attack (MITM), cryptanalysis (breaking the algorithm), implementation attack (errors in code), social engineering and side-channel attack (execution time analysis). For protection, regular software updates, use of certificates, multi-factor authentication and employee training are used. Read about protection from threats in the article Information security.

Source: term "Cryptographic protocol"

In Russian government systems (for example, Electronic Budget, SMIV), cryptographic protocols with support for domestic cryptographic information protection (for example, GOST 28147-89, GOST R 34.10-2012) are used. This ensures data protection in accordance with the requirements of 152-FZ and 187-FZ. TLS protocols with Russian cryptography are used, as well as specialized protocols for secure interagency interaction.

Source: term "Cryptographic protocol"

Hashing is the conversion of data into a unique string of fixed length (a hash). It is like a digital fingerprint: even a minimal change in the data completely changes the hash. It is impossible to restore the data from the hash back. Read about encryption in the article Data encryption.

Source: term "Hashing"

Encryption is reversible — data can be decrypted with a key. Hashing is irreversible — the original data cannot be restored from a hash. Encryption hides data, hashing verifies integrity. A key is needed for encryption, but not for hashing. Read about encryption in the article Data encryption.

Source: term "Hashing"

For general purposes — SHA-256 and SHA-3. For storing passwords — bcrypt, Argon2 or scrypt. They are specially slow, which protects against password guessing. MD5 and SHA-1 are considered outdated and insecure. Read about security in the article Information security.

Source: term "Hashing"

In the blockchain, each block contains the hash of the previous block. This links the blocks into a chain and makes the system immutable — if you change one block, all subsequent hashes will change, and the network will notice the forgery. Hashing is also used in mining. Read about the blockchain in the article Blockchain.

Source: term "Hashing"

Hashing is not encryption; it has no key and no inverse function. We do not “hide” the data, but compress it to a fixed length, losing part of the information. Therefore, it is impossible to restore the original data from just one hash. Read about encryption in the article Data encryption.

Source: term "Hashing"

Blockchain is a digital database that stores information in the form of a chain of blocks. It has no central server — copies are stored by thousands of participants. Data cannot be changed or deleted retroactively. Read about cryptocurrencies in the article Cryptocurrency.

Source: term "Blockchain"

Transactions are collected into a block, the block receives a unique digital fingerprint (a hash) and is linked to the previous block. Thousands of computers verify the correctness of the block and add it to the chain. After that it is impossible to change it. Read about hashing in the article Hashing.

Source: term "Blockchain"

Blockchain is a technology (a database), while cryptocurrency is one of the ways to use it. Like the internet and email: the internet is a technology, email is an application. Read about cryptocurrencies in the article Cryptocurrency.

Source: term "Blockchain"

Public (open to everyone), private (restricted), consortium (managed by a group of organizations) and hybrid (combines features of different types). The choice depends on the tasks: public for cryptocurrencies, private for corporate systems. Read about choosing an architecture in the article Client-server architecture.

Source: term "Blockchain"

Scalability — public blockchains process few transactions per second (Bitcoin — ~7). Also high energy consumption during mining. To solve these problems, new solutions are being developed (Layer 2, Proof of Stake). Read about scaling in the article Server cluster. To study related concepts we also recommend familiarizing yourself with Blockchain fork and Cryptanalysis.

Source: term "Blockchain"

A payment gateway is an intermediary between an online store and a bank. It accepts card data, encrypts it, transmits it to the bank for processing and returns the answer. Without it, online payment would be impossible. Read about payments in the article Cashless payments.

Source: term "Payment gateway"

The client enters card data → the gateway encrypts the data and sends it to the bank → the bank checks the availability of funds and conducts an anti-fraud check → returns the answer → the gateway passes the answer to the store → the client sees the result. The whole process takes a few seconds. Read about security in the article PCI DSS.

Source: term "Payment gateway"

YooKassa (Yandex.Kassa), Robokassa, CloudPayments, PayU, Sberbank acquiring. The choice depends on the volume of payments, payment methods, the commission and the required level of integration. Read about choosing in the article Fintech.

Source: term "Payment gateway"

A payment gateway is a specialized service for processing payments. An API gateway is a common “gatekeeper” for all requests to microservices. A payment gateway can be considered as one of the services that hides behind an API gateway. Read about API gateways in the article API gateway.

Source: term "Payment gateway"

Usually 1.5-4% of the transaction amount plus a fixed fee (for example, 5-10 rubles). Aggregators have higher commissions, but easier connection. With direct integration with a bank the commissions are lower, but integration is more complex. Read about commissions in the article Cashless payments.

Source: term "Payment gateway"

Mining is the extraction of cryptocurrency using computers. Computers solve complex mathematical problems, and whoever finds the answer first receives a reward in the form of coins. It is like a digital gold mine. Read about cryptocurrencies in the article Cryptocurrency.

Source: term "Mining"

Profitability depends on the cryptocurrency rate, network difficulty, the cost of electricity and the power of the equipment. For an accurate calculation use mining calculators. On average, the payback period of an ASIC miner is 12-24 months. Read about profitability in the article Bitcoin.

Source: term "Mining"

Mining in Russia is legal, but requires compliance with rules: registration in the registry for individual entrepreneurs and legal entities, payment of taxes and declaration. For violations — fines up to 2 million rubles with confiscation of equipment and criminal liability up to 5 years. Read about the law in the article Cryptocurrency.

Source: term "Mining"

The choice depends on the rate and difficulty. The most popular are Bitcoin (requires ASIC), as well as altcoins on graphics cards. Follow the news and use calculators to calculate profitability. Read about choosing in the article Cryptocurrency.

Source: term "Mining"

Yes, but there are nuances: high energy consumption, noise, heating and restrictions on the electrical grid. For home mining, graphics cards or small ASICs are suitable. But keep in mind — the payback may be lower due to high electricity tariffs. Read about legality in the article Cryptocurrency.

Source: term "Mining"

A fork is the division of the blockchain into two independent branches. Like a fork in the road: one group follows the new rules, another remains on the old ones. As a result, two different cryptocurrencies may appear. Read about the blockchain in the article Blockchain.

Source: term "Blockchain fork"

A hard fork is an incompatible change that creates a new cryptocurrency. The old version does not accept blocks from the new one. A soft fork is a backward-compatible update. The new version is stricter, but blocks from the old version are still accepted. A soft fork does not create a new currency. Read about cryptocurrencies in the article Cryptocurrency.

Source: term "Blockchain fork"

Bitcoin → Bitcoin Cash (2017, increase of the block size), Ethereum → Ethereum Classic (2016, return of stolen funds), Bitcoin → Bitcoin Gold (2017, change of the mining algorithm). These are only the most famous examples. Read about Bitcoin in the article Bitcoin.

Source: term "Blockchain fork"

For updating the protocol (adding functions, improving security), resolving conflicts in the community, experiments and testing new ideas. Also, cryptocurrency holders receive coins of the new currency in the same quantity. Read about the development of the blockchain in the article Blockchain.

Source: term "Blockchain fork"

Network instability in the first days, confusion with similar currency names, replay attacks (when a transaction is repeated in another network) and a reduction in overall security due to the division of the hash rate. Therefore, it is important to be careful and wait for protection against attacks. Read about security in the article Blockchain.

Source: term "Blockchain fork"

The Register of Domestic Software is an official list of software products of Russian origin, maintained by the Ministry of Digital Development, Communications and Mass Media of the Russian Federation. It is used for public procurement and import substitution: state customers give priority to products included in the Register. A key criterion for inclusion is that the rights holder is a Russian legal entity controlled by residents of the Russian Federation, with a foreign participation share of no more than 50%. Our products SINTEZ-M and SKIF-BP are included in the Register.

Source: term "Register of Domestic Software"

The Register works as a single public database of domestic software products. The Ministry of Digital Development considers applications from rights holders and, if a product meets the criteria, assigns it a registration number and determines its class. Buyers use the Register to select software for public procurement, while vendors receive tax preferences and access to the state market.

Source: term "Register of Domestic Software"

The Register is applied in state and municipal procurement: customers working under 44-FZ and 223-FZ must give priority to software from the Register. It is also used in import substitution programs for critical information infrastructure (CII), when selecting analogues of foreign products, and for granting tax preferences and grants to rights holders.

Source: term "Register of Domestic Software"

Inclusion in the Register confirms the domestic origin of the software and gives the right to participate in state and municipal procurement: customers under 44-FZ and 223-FZ must give priority to products from the Register. Rights holders also receive tax benefits (VAT exemption on sales), access to grants and preferential lending, and increased customer trust. Our products SINTEZ-M and SKIF-BP are included in the Register.

Source: term "Register of Domestic Software"

To be included in the Register, a product must be of Russian origin: the rights holder is a Russian legal entity controlled by residents of the Russian Federation. The software must not contain significant borrowings from foreign products, and Russian cryptographic algorithms must be used where required. The rights holder must also demonstrate economic viability — revenue from sales, a development staff and development plans.

Source: term "Register of Domestic Software"

The Register is publicly available and can be searched by product name, rights holder or product class. Each entry contains the registration number, the software class and information about the rights holder. Checking the Register is important when selecting software for state procurement, since only products from the Register can participate.

Source: term "Register of Domestic Software"

Several Fintech products are included in the Register of Domestic Software: the SINTEZ-M platform (low-code development, class 04.06 — software development tools); the SKIF-BP system (budget process, class 02.09 — financial management systems); and the Biomark platform (biometric identification, class 05.14 — information protection tools). Their presence in the Register confirms their domestic origin and allows their use in state and municipal procurement.

Source: term "Register of Domestic Software"

The budget rule is a financial safety cushion for the country. At high oil prices the state saves part of the income in the National Wealth Fund; at low prices it uses the savings to fulfill obligations.

Source: term "Budget rule"

It smooths fluctuations: the Ministry of Finance buys currency at high oil prices (strengthening the ruble) and sells at low prices (restraining the fall).

Source: term "Budget rule"

The rule determines the volume of funds for subsidizing. The higher the cutoff price and savings, the more opportunities for support programs.

Source: term "Budget rule"

It is the base oil price set in the budget (e.g. $59 per barrel of Urals). Above it — windfall revenues go to reserves; below it — the deficit is covered from reserves.

Source: term "Budget rule"

No, but its parameters are periodically revised. A transition to a structural balance rule is being discussed for 2023-2026.

Source: term "Budget rule"

The Stabilization Fund was created in 2004. In 2008 it was split into the Reserve Fund and the National Wealth Fund. Since 2018 all funds are consolidated in the NWF.

Source: term "Budget rule"

Indirectly through the money supply and the ruble exchange rate. Currency purchases at high oil prices strengthen the ruble and restrain inflation.

Source: term "Budget rule"

A subsidy is targeted assistance requiring a report on targeted use. A grant covers losses and can be spent on current needs without strict reporting.

Source: term "Subsidizing"

Citizens whose utility costs exceed the established share of income (usually 22%), including low-income families, pensioners and large families.

Source: term "Subsidizing"

Register an IP or LLC, prepare a business plan and submit an application to the My Business center. Reporting via electronic document flow.

Source: term "Subsidizing"

No, if all program conditions are met and targeted use is confirmed. Otherwise the subsidy must be returned to the budget.

Source: term "Subsidizing"

From federal, regional and local budgets, including funds accumulated under the budget rule (National Wealth Fund).

Source: term "Subsidizing"

Depending on the type: passport, income certificate, business plan, cost estimate. The full list is specified in the relevant department.

Source: term "Subsidizing"

Usually from 10 to 30 days. In some cases it may increase to 60 days.

Source: term "Subsidizing"

Open Source code is open for study and modification. Proprietary software code is closed and requires purchasing a license.

Source: term "Open Source"

Yes, the code is open and reviewed by a global community. For CII facilities, FSTEC-certified solutions are recommended.

Source: term "Open Source"

Yes, including Astra Linux and Postgres Pro, which are in the Register of Russian Software.

Source: term "Open Source"

GPL, MIT, Apache. The choice affects use in commercial products and government systems.

Source: term "Open Source"

It allows creating domestic solutions on the basis of proven open code, reducing dependence on foreign vendors.

Source: term "Open Source"

Astra Linux, Postgres Pro, RED OS, Alt OS, LibreOffice, Angie.

Source: term "Open Source"

Independent support needed, compatibility issues, no vendor guarantees. Regular audit is recommended. See also software fork.

Source: term "Open Source"

A fork is the creation of a copy of a project's source code for independent development, like a branch off the main road.

Source: term "Software fork"

Fork is a copy on the platform linked to the original for Pull Requests. Clone is a local copy on your computer.

Source: term "Software fork"

To add functionality, fix errors, adapt to specific tasks, or in case of disagreements with the original project's development.

Source: term "Software fork"

Angie (Nginx fork), Postgres Pro (PostgreSQL fork), RED OS. These are included in the Register of Russian Software.

Source: term "Software fork"

Independent code support, compatibility problems, duplicated effort. Risks are minimized by inclusion in the register and certification.

Source: term "Software fork"

Open the repository page, press the Fork button. Clone the fork, make changes, create a Pull Request to the original project.

Source: term "Software fork"

Yes, depending on the license. MIT/Apache allow commercial use. GPL requires opening the modified code.

Source: term "Software fork"

Astra Linux, RED OS, Alt OS, ROSA Linux. They support Russian DBMS and cryptographic protection tools.

Source: term "Alternative software"

Russian-7 Office, MyOffice, LibreOffice. For documents, EDF systems integrating with domestic office suites are used.

Source: term "Alternative software"

Postgres Pro, Tantor, Red Database, LINTER. They are used in state systems and at CII facilities.

Source: term "Alternative software"

It is a complex process taking 6-24 months: data migration, training and integration. With proper planning it can be done without significant downtime.

Source: term "Alternative software"

SINTEZ-M, ELMA 365, SimpleOne, Visary. They offer similar functionality to Microsoft Power Apps and Mendix.

Source: term "Alternative software"

Inclusion in the Register of Russian Software, FSTEC certification, support for CIPF with GOST algorithms.

Source: term "Alternative software"

Audit, selection, testing, data migration, staff training, implementation. Conduct the transition in stages.

Source: term "Alternative software"

A database is the data itself. A DBMS is the program that manages it. PostgreSQL is a DBMS; the data it stores is a database.

Source: term "Database management system (DBMS)"

Postgres Pro, Tantor, Red Database and LINTER, included in the Register of Russian Software.

Source: term "Database management system (DBMS)"

Data organized as linked tables, using SQL, providing ACID transactions. Used in banks and document flow.

Source: term "Database management system (DBMS)"

NoSQL does not use traditional relational models. Used for unstructured data and high loads: MongoDB, Redis, Cassandra, Neo4j.

Source: term "Database management system (DBMS)"

Consider data structure, transaction requirements, volume, load, scaling and certification requirements.

Source: term "Database management system (DBMS)"

FSTEC certification, CIPF, access control, auditing and integration with SIEM.

Source: term "Database management system (DBMS)"

SQL knowledge, database normalization, query optimization. Administrator skills include performance tuning and backup management.

Source: term "Database management system (DBMS)"

152-FZ, 187-FZ, 63-FZ, 149-FZ, 44-FZ and 223-FZ.

Source: term "Government regulation in IT"

The transition of government bodies and CII facilities to domestic software, regulated by government resolutions. Software from the Register is mandatory.

Source: term "Government regulation in IT"

CIPF must be certified by the FSB and implement GOST algorithms.

Source: term "Government regulation in IT"

Reduced insurance premiums (7.6%), 3% profit tax, VAT exemption, grants and preferential loans. Accreditation with the Ministry of Digital Development is required.

Source: term "Government regulation in IT"

For state systems, platforms must be in the Register and support CIPF and electronic signatures.

Source: term "Government regulation in IT"

Personal data of Russian citizens must be stored and processed on servers in Russia (152-FZ, 242-FZ).

Source: term "Government regulation in IT"

Stricter CII requirements, AI regulation, increased fines for personal data violations and further import substitution.

Source: term "Government regulation in IT"

A license is the rules by which you can use a program. It defines: how many installs, whether you can change the code and whether you can transfer it to others. Without a license, using software is illegal.

Source: term "Software licenses"

MIT is the most permissive license: it can be used, modified and sold without restrictions. GPL requires that all changes be distributed under the same license (copyleft). MIT is easier for commercial use.

Source: term "Software licenses"

Yes, open-source also requires a license. An open-source license (MIT, GPL, Apache) defines the conditions of use and distribution of the code. Without a license, the code is automatically protected by copyright.

Source: term "Software licenses"

A backup system (SRK) is a set of hardware and software tools for automatically creating backup copies of data and their rapid recovery in case of loss, damage or encryption by ransomware. The key task is to ensure data safety under any failures and cyberattacks. Read more about related aspects in the materials: SAN (storage area network) and Data warehouse.

Source: term "Backup system (SRK)"

The need for a backup system arises from the risks of data loss due to technical failures, human errors, hardware failures and cyberattacks, primarily ransomware. Backup protects against such threats by storing copies on separate media. Read more about related aspects in the materials: Data warehouse and installation works.

Source: term "Backup system (SRK)"

Building an effective backup system requires an integrated approach: determining RPO and RTO, choosing backup methods (full, incremental, differential) and storage (storage system, tape library, cloud). We also recommend familiarizing yourself with Hypervisor, Server virtualization and Postgres Pro for a complete understanding of the topic.

Source: term "Backup system (SRK)"

When building a backup system, you should avoid storing copies in the same logical environment as the main data (this does not protect against ransomware), ignoring the 3-2-1 rule and not testing recovery procedures. In the context of this topic, it is useful to study Containerization (Docker) and SMEV (interdepartmental electronic interaction system).

Source: term "Backup system (SRK)"

Backup copies can be confused with archiving: archive stores data for long-term storage, and backup is designed for rapid recovery after failures. These are different tasks with different approaches. For in-depth study, refer to the sections SMEV, COD technology and Hypervisor.

Source: term "Backup system (SRK)"

To confirm that the backup system works, regular test restores are performed — the actual recovery of data from copies in a test environment. Monitoring backup statuses, checking reports and periodic audit of recovery procedures are also used. More detailed information is available in the articles about SAN, Thin client and installation works.

Source: term "Backup system (SRK)"

Data recovery time depends on the RTO set and the recovery method: restoring from a full copy takes longer than from differential or incremental ones. For critical systems, RTO can be minutes, which requires the use of continuous data protection (CDP). Read more about related aspects in the materials: SAN (storage area network) and Hypervisor.

Source: term "Backup system (SRK)"

A virtualization server (virtualization host) is a technology or a physical computer that, with the help of special software (a hypervisor), divides its hardware resources (processors, memory, disks) into several independent virtual machines. For in-depth study, refer to the sections Containerization (Docker), Hypervisor and SAN (storage area network).

Source: term "Server virtualization"

The main types are: full hardware-assisted virtualization (the hypervisor fully emulates hardware), paravirtualization (the guest OS is modified for higher performance) and OS-level virtualization (containers that share the host kernel). For in-depth study, refer to the sections Containerization (Docker), Hypervisor and installation works.

Source: term "Server virtualization"

The advantages of server virtualization are as follows: efficient use of equipment (utilization increases from 10-15% to 70-80%), reduction of capital and operating costs, simplified management and high fault tolerance. More detailed information is available in the articles about Data warehouse, Workstation and data center (DPC).

Source: term "Server virtualization"

Server virtualization is a technology that allows dividing the resources of one physical server into several isolated virtual machines (VMs). We also recommend familiarizing yourself with SAN (storage area network) and Thin client for a complete understanding of the topic.

Source: term "Server virtualization"

Server virtualization is the process of dividing a physical server into several unique and isolated virtual servers using a software application. We also recommend familiarizing yourself with Postgres Pro, SAN (storage area network) and Thin client for a complete understanding of the topic.

Source: term "Server virtualization"

A virtual server (VPS or VDS) is an isolated virtual environment that emulates the operation of a separate physical computer. We also recommend familiarizing yourself with Backup system (SRK), Hypervisor and installation works for a complete understanding of the topic.

Source: term "Server virtualization"

Virtualization is a technology for creating software (virtual) copies of physical computers, servers or networks. For in-depth study, refer to the sections installation works, Workstation and Containerization (Docker).

Source: term "Server virtualization"

Containerization is a method of packaging a program together with all its components (code, libraries and settings) into an isolated environment — a container. For in-depth study, refer to the sections Sintezm and Postgres Pro.

Source: term "Containerization (Docker)"

The main difference is in the abstraction level: virtualization emulates a whole physical device (computer), while containerization isolates only the application itself and its dependencies within a single operating system. More detailed information is available in the articles about Thin client and Data warehouse.

Source: term "Containerization (Docker)"

Docker is a platform for creating, delivering and running containers. Docker allows packaging applications with all dependencies into images and running them in isolation on the host. More detailed information is available in the articles about SAN (storage area network), Hypervisor and Data warehouse.

Source: term "Containerization (Docker)"

Containerization in IT is a method of packaging an application together with all the dependencies necessary for its operation (libraries, settings, files) into a single image — a container. We also recommend familiarizing yourself with SAN (storage area network) and Postgres Pro for a complete understanding of the topic.

Source: term "Containerization (Docker)"

Containerization provides isolation of applications, lightweight and fast startup, portability of environments, efficient use of server resources and simplified deployment and scaling of microservices. For in-depth study, refer to the sections Server virtualization and Hypervisor.

Source: term "Containerization (Docker)"

Docker images are immutable, that is, they cannot be changed after creation. Containerization is a broader concept — a method of isolating applications, while Docker is a specific tool for its implementation. For in-depth study, refer to the sections data center (DPC), Server virtualization and Data warehouse.

Source: term "Containerization (Docker)"

Virtualization and containerization have their own strengths. Virtualization provides stronger isolation and runs any OS, while containerization is lighter and faster, ideal for microservices. They are often used together. In the context of this topic, it is useful to study Data warehouse, SAN (storage area network) and Backup system (SRK).

Source: term "Containerization (Docker)"

DPC stands for data processing center (also often called a data center). In the context of this topic, it is useful to study Data warehouse, Thin client and Backup system (SRK).

Source: term "Data center (DPC)"

A data center (DPC) is a "digital fortress", a large specialized room or building where thousands of servers and data storage systems are located. In the context of this topic, it is useful to study Postgres Pro and the virtualization technology.

Source: term "Data center (DPC)"

According to international analytical databases and industry experts, there are about 180-195 data processing centers (data centers) in Russia. Read more about related aspects in the materials: virtualization technology, SAN (storage area network) and SMEV (interdepartmental electronic interaction system).

Source: term "Data center (DPC)"

A data center (DPC) is a specialized facility or complex of buildings designed for placing, connecting and uninterrupted operation of server and network equipment. In the context of this topic, it is useful to study Workstation and Server virtualization.

Source: term "Data center (DPC)"

DPC stands for data processing center (the English term Data Center is also often used). This is a specialized high-tech complex (or a separate building) designed for placing, connecting to the internet and uninterrupted operation of server equipment, data storage systems and communication nodes. We also recommend familiarizing yourself with the scaling technology, Hypervisor and SAN (storage area network) for a complete understanding of the topic.

Source: term "Data center (DPC)"

The Uptime Institute defines four availability tiers: Tier I (basic, ~99.671% availability), Tier II (redundant components), Tier III (concurrently maintainable, ~99.982%) and Tier IV (fault-tolerant, ~99.995%). The higher the tier, the higher the reliability and the cost of the data center. We also recommend familiarizing yourself with scaling technology and Hypervisor for a complete understanding of the topic.