title: ÐÐ½ÑÐµÐ³ÑÐ°ÑÐ¸Ñ ÑÐ¸ÑÑÐµÐ¼Ñ UserGate Ñ ÑÐµÑÐ²Ð¸ÑÐ¾Ð¼ Yandex Cloud Ð´Ð»Ñ Ð·Ð°ÑÐ¸ÑÑ Ð¾Ð±Ð»Ð°ÑÐ½ÑÑ ÑÐµÑÑÑÑÐ¾Ð² Ð¿ÑÐµÐ´Ð¿ÑÐ¸ÑÑÐ¸Ñ
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¼Ð°Ð³Ð¸ÑÑÑÐ°
titleType: Subtitle
title: Development and Implementation of a Security Policy Description Language for Cloud Environments: A Case Study of Yandex Cloud
Creators: name: ÐÑÑÐµÑÐµÐ½ÐºÐ¾, ÐÐ½ÑÐ¾Ð½
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2024
Subjects: Ð¾Ð±Ð»Ð°ÑÐ½ÑÐµ ÑÑÐµÐ´Ñ
Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÑ
ÑÐ½Ð´ÐµÐºÑ Ð¾Ð±Ð»Ð°ÐºÐ¾
ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ðµ Ð¿Ð¾Ð»Ð¸ÑÐ¸ÐºÐ°Ð¼Ð¸
ÑÐ¸ÑÑÐ¾Ð²Ð°Ð½Ð¸Ðµ
Ð´Ð¾ÑÑÑÐ¿
Ð¸Ð½ÑÐµÐ³ÑÐ°ÑÐ¸Ñ
cloud environmets
security
yandex cloud
policy management
encryption
access
integration

description: Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¸ Ð²Ð½ÐµÐ´ÑÐµÐ½Ð¸Ðµ ÑÐ·ÑÐºÐ° Ð¾Ð¿Ð¸ÑÐ°Ð½Ð¸Ñ Ð¿Ð¾Ð»Ð¸ÑÐ¸Ðº Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð´Ð»Ñ Ð¿Ð¾Ð²ÑÑÐµÐ½Ð¸Ñ ÑÑÐ¾Ð²Ð½Ñ Ð·Ð°ÑÐ¸ÑÑ Ð´Ð°Ð½Ð½ÑÑ Ð¸ Ð¸Ð½ÑÑÐ°ÑÑÑÑÐºÑÑÑÑ Ð² Ð¾Ð±Ð»Ð°ÑÐ½ÑÑ ÑÑÐµÐ´Ð°Ñ, Ð½Ð° Ð¿ÑÐ¸Ð¼ÐµÑÐµ Ð¿Ð»Ð°ÑÑÐ¾ÑÐ¼Ñ Yandex Cloud. ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÑÑÑÑ Ð¼ÐµÑÐ¾Ð´Ñ Ð¸ Ð¸Ð½ÑÑÑÑÐ¼ÐµÐ½ÑÑ Ð´Ð»Ñ ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ, ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ Ð¸ Ð¼Ð¾Ð½Ð¸ÑÐ¾ÑÐ¸Ð½Ð³Ð° Ð¿Ð¾Ð»Ð¸ÑÐ¸Ðº Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð² Ð¾Ð±Ð»Ð°ÑÐ½ÑÑ ÑÑÐµÐ´Ð°Ñ. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: Â  Â  1. ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ Ð¿Ð¾Ð´ÑÐ¾Ð´Ð¾Ð² Ðº Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð¾Ð±Ð»Ð°ÑÐ½ÑÑ ÑÑÐµÐ´. Â  Â  2. ÐÐ½Ð°Ð»Ð¸Ð· Ð°ÐºÑÑÐ°Ð»ÑÐ½ÑÑ ÑÐ³ÑÐ¾Ð· Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð¾Ð±Ð»Ð°ÑÐ½ÑÑ ÑÐµÑÐµÐ½Ð¸Ð¹. Â  Â  3. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¼Ð¾Ð´ÐµÐ»Ð¸ ÑÐ·ÑÐºÐ° Ð¾Ð¿Ð¸ÑÐ°Ð½Ð¸Ñ Ð¿Ð¾Ð»Ð¸ÑÐ¸Ðº Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸. Â  Â  4. ÐÐ½ÑÐµÐ³ÑÐ°ÑÐ¸Ñ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ ÑÐ·ÑÐºÐ° Ñ Ð¿Ð»Ð°ÑÑÐ¾ÑÐ¼Ð¾Ð¹ Yandex Cloud. Â  Â  5. ÐÑÐµÐ½ÐºÐ° ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ Ð²Ð½ÐµÐ´ÑÐµÐ½Ð½ÑÑ Ð¿Ð¾Ð»Ð¸ÑÐ¸Ðº Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸. Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ» Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½ Ð²ÑÐµÑÑÐ¾ÑÐ¾Ð½Ð½Ð¸Ð¹ Ð°Ð½Ð°Ð»Ð¸Ð· ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ Ð¿Ð¾Ð´ÑÐ¾Ð´Ð¾Ð² Ðº Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð¾Ð±Ð»Ð°ÑÐ½ÑÑ ÑÑÐµÐ´ Ð¸ Ð²ÑÑÐ²Ð»ÐµÐ½Ñ Ð¾ÑÐ½Ð¾Ð²Ð½ÑÐµ ÑÐ³ÑÐ¾Ð·Ñ, ÑÐ°ÐºÐ¸Ðµ ÐºÐ°Ðº ÑÑÐµÑÐºÐ° Ð´Ð°Ð½Ð½ÑÑ, Ð½Ð°ÑÑÑÐµÐ½Ð¸Ðµ ÑÐµÐ»Ð¾ÑÑÐ½Ð¾ÑÑÐ¸ Ð´Ð°Ð½Ð½ÑÑ, Ð¾ÑÐºÐ°Ð· Ð² Ð¾Ð±ÑÐ»ÑÐ¶Ð¸Ð²Ð°Ð½Ð¸Ð¸ (DoS/DDoS), ÑÐ³ÑÐ¾Ð·Ñ ÑÑÐµÑÐ½ÑÐ¼ Ð´Ð°Ð½Ð½ÑÐ¼ Ð¸ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐ¸ Ð² ÑÐ¸ÑÑÐµÐ¼Ð°Ñ Ð²Ð¸ÑÑÑÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ð¸. ÐÑÐ»Ð¸ ÑÐ°ÑÑÐ¼Ð¾ÑÑÐµÐ½Ñ Ð¾ÑÐ½Ð¾Ð²Ð½ÑÐµ Ð¿ÑÐ¸Ð½ÑÐ¸Ð¿Ñ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ¸ Ð¿Ð¾Ð»Ð¸ÑÐ¸Ðº Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸, Ð´ÐµÐ¹ÑÑÐ²ÑÑÑÐ¸Ðµ Ð² Ð Ð¾ÑÑÐ¸Ð¹ÑÐºÐ¾Ð¹ Ð¤ÐµÐ´ÐµÑÐ°ÑÐ¸Ð¸. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð° ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð° Ð¼Ð¾Ð´ÐµÐ»Ñ ÑÐ·ÑÐºÐ° Ð¾Ð¿Ð¸ÑÐ°Ð½Ð¸Ñ Ð¿Ð¾Ð»Ð¸ÑÐ¸Ðº Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸, Ð²ÐºÐ»ÑÑÐ°ÑÑÐ°Ñ ÑÐµÐ»Ð¸ Ð¸ Ð·Ð°Ð´Ð°ÑÐ¸, Ð°ÑÑÐ¸ÑÐµÐºÑÑÑÑ Ð¸ ÑÑÑÑÐºÑÑÑÑ ÑÐ·ÑÐºÐ°. ÐÑÐ¸Ð¼ÐµÑÑ Ð¿Ð¾Ð»Ð¸ÑÐ¸Ðº ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ Ð´Ð¾ÑÑÑÐ¿Ð¾Ð¼ Ð¸ ÑÐ¸ÑÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð´Ð°Ð½Ð½ÑÑ, Ð° ÑÐ°ÐºÐ¶Ðµ Ð¼ÐµÑÐ¾Ð´Ñ Ð¸Ñ Ð²Ð½ÐµÐ´ÑÐµÐ½Ð¸Ñ ÑÐµÑÐµÐ· Yandex Cloud API Ð¿Ð¾ÐºÐ°Ð·Ð°Ð»Ð¸ ÑÐ²Ð¾Ñ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÑ Ð² ÑÐµÐ°Ð»ÑÐ½ÑÑ ÑÑÐµÐ½Ð°ÑÐ¸ÑÑ. ÐÑÐµÐ½ÐºÐ° ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ Ð¿Ð¾Ð»Ð¸ÑÐ¸Ðº Ð¿ÑÐ¾Ð´ÐµÐ¼Ð¾Ð½ÑÑÑÐ¸ÑÐ¾Ð²Ð°Ð»Ð° Ð·Ð½Ð°ÑÐ¸ÑÐµÐ»ÑÐ½Ð¾Ðµ ÑÐ»ÑÑÑÐµÐ½Ð¸Ðµ ÑÑÐ¾Ð²Ð½Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸: ÐºÐ¾Ð»Ð¸ÑÐµÑÑÐ²Ð¾ ÑÑÐ¿ÐµÑÐ½ÑÑ Ð°ÑÐ°Ðº Ð½Ð° ÑÐ¸ÑÑÐµÐ¼Ñ ÑÐ¼ÐµÐ½ÑÑÐ¸Ð»Ð¾ÑÑ, Ð²ÑÐµÐ¼Ñ Ð²Ð¾ÑÑÑÐ°Ð½Ð¾Ð²Ð»ÐµÐ½Ð¸Ñ Ð¿Ð¾ÑÐ»Ðµ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² ÑÐ¾ÐºÑÐ°ÑÐ¸Ð»Ð¾ÑÑ, Ð° ÑÑÐ¾Ð²ÐµÐ½Ñ ÑÐ¾Ð¾ÑÐ²ÐµÑÑÑÐ²Ð¸Ñ ÑÑÐµÐ±Ð¾Ð²Ð°Ð½Ð¸ÑÐ¼ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð¿Ð¾Ð²ÑÑÐ¸Ð»ÑÑ. ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð² ÐºÐ°ÑÐµÑÑÐ²Ðµ Ð¾ÑÐ½Ð¾Ð²Ñ Ð´Ð»Ñ Ð´Ð°Ð»ÑÐ½ÐµÐ¹ÑÐµÐ³Ð¾ ÑÐ°Ð·Ð²Ð¸ÑÐ¸Ñ Ð¸ Ð¾Ð¿ÑÐ¸Ð¼Ð¸Ð·Ð°ÑÐ¸Ð¸ ÑÐ¸ÑÑÐµÐ¼ ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÑÑ Ð² Ð¾Ð±Ð»Ð°ÑÐ½ÑÑ ÑÑÐµÐ´Ð°Ñ, Ð° ÑÐ°ÐºÐ¶Ðµ Ð´Ð»Ñ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ¸ Ð½Ð¾Ð²ÑÑ Ð¸Ð½ÑÑÑÑÐ¼ÐµÐ½ÑÐ¾Ð² Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ Ð¿ÑÐ¾ÑÐµÑÑÐ¾Ð² ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ Ð¸ Ð¼Ð¾Ð½Ð¸ÑÐ¾ÑÐ¸Ð½Ð³Ð° Ð¿Ð¾Ð»Ð¸ÑÐ¸Ðº Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸.
description: The objective of this thesis is to develop and implement a security policy description language to enhance the protection of data and infrastructure in cloud environments, using Yandex Cloud as a case study. The subject of the research is methods and tools for creating, managing, and monitoring security policies in cloud environments. The tasks addressed in the course of the research include: Â  Â  1. Investigating existing approaches to ensuring the security of cloud environments. Â  Â  2. Analyzing current security threats to cloud solutions. Â  Â  3. Developing a model for the security policy description language. Â  Â  4. Integrating the developed language with the Yandex Cloud platform. Â  Â  5. Assessing the effectiveness of the implemented security policies. Throughout the research, a comprehensive analysis of existing approaches to ensuring cloud environment security was conducted, and major threats such as data breaches, data integrity violations, denial of service (DoS/DDoS), credential threats, and virtualization system vulnerabilities were identified. The main principles of security policy development in the Russian Federation were also examined. As a result, a model for the security policy description language was developed, outlining its goals, objectives, architecture, and structure. Examples of access control and data encryption policies, as well as methods for their implementation via Yandex Cloud API, demonstrated their effectiveness in real-world scenarios. The assessment of policy effectiveness showed a significant improvement in security levels: the number of successful attacks on the system decreased, recovery time after incidents was reduced, and compliance with security requirements increased. The obtained results can serve as a basis for further development and optimization of security management systems in cloud environments, as well as for the development of new tools for automating the processes of policy creation and monitoring.