Anastasiia Voitova, Head of Security Engineering at Cossack Labs, had a chance to share experience we are gaining in Ukraine: protecting defence digital capabilities, securing large-scale ecosystems, and building solutions for virtualising OT in critical national infrastructure.
A few key thoughts from the discussion:
The Ukrainian defence technology ecosystem is vast and wonderfully chaotic: C5ISR and COP platforms, IIoT devices, sensors, robotic systems, fleet management, battlefield integrations, data exchange layers – and all of it connected to everything else.
These systems operate in real-time and near real-time, process large volumes of un-/classified data, and continuously exchange information across trust boundaries.
The battlefield evolves quickly, so systems evolve quickly too. Release cycles are short. Threat actors, unfortunately, remain highly motivated and rarely take bank holidays.
In these conditions, there is no such thing as a permanently “secure system”. There is only a system “authorised to operate” under a particular risk model, for a particular release, with a particular feature set.
We design for failure and build layered, interconnected, independent defences. ZT, DCS, CDSS, DiD.
We are often forced to rethink traditional assumptions around on-prem infra and clouds. Losing operational availability after a missile strike on a datacentre is generally considered a poor user experience.
During development we follow SSDLC, build security controls around security profiles and threat models, and adapt them continuously through reassessment. We use multiple standards, from OWASP to NIST, and tailor requirements separately for software, drones, and data exchange systems.
Keeping this technological “zoo” reasonably secure requires constant engineering support: helping developers, sharing practices, enforcing controls, assessing and reassessing systems, and occasionally trying to explain why “temporary workaround” should not become architecture.
No single tool is enough. No single standard covers enough. Complex and adaptive threats require equally complex and adaptive defences." Honoured to have the opportunity to share these experiences. Very good discussions, thoughtful follow-up questions, and ongoing support from the community.
The presentation itself is TLP:AMBER, as it references real-world operational solutions.
