Information security

Key documents

Our approach to information security management

Magnit’s information security is based on a set of interrelated organisational and technical tools which comprise an integrated information security management and assurance system. Our comprehensive approach enables us to protect ourselves against modern cyber threats, comply with Russian legal requirements and international standards, and prevent financial, reputational and other damage. The Company’s information security system is designed and developed in line with global best practices.

Magnit has a formalised procedure for internal auditing, which falls within the remit of a dedicated department. We regularly assess information security risks and test our information systems on a quarterly basis.

Cyber security system

In line with our commitment to maintaining a cyber security system, we identify and eliminate vulnerabilities in information devices, search for viruses and zero-day attacksZero-day — an exposed software vulnerability or malware with no identified means of containment, while also monitoring and responding to security incidents. Magnit monitors the integrity of software architecture across all of its external IT services. We carry out scheduled updates of network devices, servers and software.

We run daily scans of all of the Company’s external addresses for known vulnerabilities and eliminate all threats. All of Magnit’s web services are protected through web application firewalls (WAFs), designed to detect and block network attacks on web applications. We actively employ anti-DDoS solutionsAnti-DDoS is a tool of protection against DDoS attacks, which aim to disrupt the computer system through a constant stream of requests., and regularly scan open internet ports. Twice a year, Magnit conducts an external independent penetration testing of its IT system.

In 2022, we saw a significant increase in the number of cyber attacks on Magnit’s IT assets. Tens of thousands of scanning and network attacks by hackers were detected, as well as more than 500,000 attempts to infect our IT infrastructure with malware through the email system. We have taken additional steps to enhance our security and were able to successfully withstand cyber attacks and avoid any disruptions in the infrastructure’s operations.

In addition, we have started transitioning to domestic IT security solutions as foreign vendors in this area have left the Russian market. In 2023, we will continue to implement information security tools offered by leading Russian developers.

To ensure the information security of our customers, we have implemented the Anti-Fraud system, which offers:

In 2023, we plan to conduct an audit of personal data processing procedures to ensure compliance with the requirements of Federal Law No. 152-FZ On Personal Data dated 27 July 2006. In addition to this, we intend to develop DevSecOpsDevSecOps (short for development, security, and operations) is the practice of integrating security testing at every stage of the software development process. processes and standardise approaches and tools used by our development teams.

Development of IT security competencies

One of our information security priorities is to make employees more aware of cyber security rules. We lay particular emphasis on the training and professional development of the employees at our IT Department who are involved in ensuring the operability of Magnit’s IT infrastructure and information systems. Other departments working with IT systems in their day-to-day operations also hold regular trainings. We regularly train our employees working in various departments responsible for personal data processing.

To ensure the security of remote and hybrid work, we have developed and launched a distributed, geographically resilient, and scalable remote access system for all employees of the Company’s head office and branches. This helped us ensure business process continuity and increase employee mobility. We are exploring opportunities to optimise office space, expand the geography of sourcing candidates for positions in the Company, and make our employees’ work more comfortable.

We continue to focus on information security while navigating the transition to remote working. Among other things, our employees now always use two-factor authentication when connecting to the Company’s systems, and also have various security products and policies run on their corporate devices which track and block attempts to gain unauthorised access and compromise users’ accounts.

Protection of personal data