Методология многоуровневой защиты данных для информационных систем «1С»

Digital infrastructure has long ceased to be a mere auxiliary element of business: today it largely determines how quickly and accurately an enterprise makes management decisions, serves its customers, and maintains its internal records. The rapid growth in the volume of processed information, the widening range of automated processes, and the pervasive spread of network services generate a steady demand for IT solutions capable of combining high performance with reliable data protection

As the volume of stored information grows, so do the risks associated with breaches of its confidentiality, integrity, and availability. Even a single incident — a leak of customers' personal data, the substitution of source documents, or the loss of access to a working database — can result in serious financial losses, regulatory sanctions, and reputational damage for an organization. This makes the development of holistic protection methods that take into account the architecture of specific information systems and the features of the corporate IT environment a practically urgent task.

The range of threats faced by 1C-based information systems is extremely broad: malware, the actions of external attackers, administration errors, hardware failures, unintentional actions by employees, and vulnerabilities in both the applied solutions and the platform itself. The task of the database administrator is to ensure protection throughout the entire life cycle of the system — from the initial allocation of access rights to the continuous monitoring of user activity and the handling of incidents

This work is devoted to analyzing the approaches to data protection currently used in 1C systems, identifying their weaknesses, and building on this basis a more balanced methodology that combines organizational, technical, and software mechanisms. The key principle underlying the study is multi-layeredness: in our view, sustainable protection cannot be achieved by purely technological or purely regulatory means taken separately; a combination of tools, procedures, and staff competencies working in concert is required.

The study covers the entire cycle of work — from a review and comparison of known solutions to the development of an original methodology, its verification in a test environment, and an assessment of the resulting effect. The ultimate goal is a tangible increase in the security of corporate data stored in 1C databases and a reduction in the probability of the successful realization of both external and internal threats.

The relevance of the topic is driven by several simultaneously acting trends. The first is the steady growth in the number and sophistication of cyber threats: the number of incidents involving unauthorized access to corporate databases increases year on year, and the attacks themselves are increasingly targeted

The object of the study is the process of administering and protecting the database management system used by the 1C platform.

The subject of the study is the interconnected set of organizational, software-technical, and educational means of ensuring the confidentiality, integrity, and availability of data, considered in relation to the operating modes and built-in mechanisms of the 1C platform during the administration of systems of this class.

The aim of the work is to develop and experimentally verify a practically applicable protection methodology that takes into account both the features of 1C database operation and the typical architectural solutions of corporate IT infrastructures, while ensuring a tangible increase in data security with an acceptable level of system performance.

Achieving this aim involves solving the following tasks:

1) to carry out a critical review of current protection methods and assess the actual level of data security in a typical 1C administration scenario;

2) to identify the strengths and weaknesses of these methods, as well as their characteristic residual risks;

3) to formulate a comprehensive methodology combining organizational, technical, and educational measures;

4) to conduct testing and validation of the methodology under conditions that model real corporate operation;

5) to prepare practical recommendations and a regulation suitable for implementing the methodology at an enterprise.

The methodological basis of the work comprises a comparative analysis of existing approaches to database protection, threat modeling using the STRIDE methodology, the design of a comprehensive methodology based on classical information-security principles, and the experimental verification of the proposed solutions in an isolated test environment with subsequent validation on a copy of a working 1C database.

The scientific novelty of the work is as follows. First, the typical multi-level protection model is adapted to the architecture and operating modes of the 1C platform — file-based and client-server — relying on its built-in mechanisms: the role-based rights model, record-level access restriction, the registration log, and scheduled jobs. Second, organizational, technical, and educational measures are combined into a single verified methodology, whereas in most known solutions they are applied in isolation

Examining the methodological approaches to database protection in the course of administering 1C applied solutions is not a formal introductory section but a substantive starting point of the study. The modern information environment exists amid a constant escalation of cyber threats, and this background cannot be ignored. 1C databases store information that is critically important for the operation of any organization: financial aggregates, information about counterparties and employees, elements of trade secrets, and operational business-process data. For this reason, the protection of such databases cannot be limited to any single layer or technology — it requires constant revision and a comprehensive approach.

The methods used today can conveniently be grouped into three large directions that differ in the nature of the means employed.

The first direction consists of organizational measures: the development of local regulations on data protection, the assignment of personal responsibility for compliance with them, and regular staff training. Security policies here play the role of a framework — they formalize the rules of access to information resources, describe the procedure for processing data, and regulate actions in the event of an incident.

The second direction comprises technical means of protection. These include cryptographic mechanisms, access-control tools, and the regular updating of software. Encryption practically rules out the possibility of reading data without a key even if it is intercepted; a properly configured access-control system shuts out users who lack the necessary privileges; and timely software updates close known vulnerabilities and reduce the system's susceptibility to external attacks.

The third direction is monitoring and auditing. Its task is to record deviations from the system's normal behavior and to suppress threats before they are fully realized. This includes observing user actions, analyzing event logs, and applying automated audit tools that make it possible to recognize anomalies, detect attempts at unauthorized access, and reconstruct the course of incidents. It is fundamentally important that data collection in itself is meaningless — value is gained only from its systematic analytical processing.

The starting point for building a protection system is a correct assessment of the threats affecting the database infrastructure. By their source, they are conventionally divided into internal and external. Internal threats, as practice shows, most often arise from the human factor — whether poor staff training, the violation of regulations, or unintentional errors. External threats are associated with the deliberate actions of attackers: network attacks, the spread of malware, and the use of social-engineering methods.

To systematize possible threat scenarios and subsequently assess risks, special models are used. Among them, the STRIDE model has become especially widespread, combining six characteristic types of threats:

• S — Spoofing (identity spoofing);

• T — Tampering (violation of integrity);

• R — Repudiation (denial of actions performed);

• I — Information Disclosure;

• D — Denial of Service (violation of availability);

• E — Elevation of Privilege.

An effective security methodology must take into account the evolution of threats and follow changes in the arsenal of protection tools. In essence, this is not a one-off project but a continuous process of adaptation: an analytical review of new risks, the adjustment of measures, and the introduction of up-to-date tools — all of this should become regular practice (Table 1).

Among the architectural approaches to building protection, the most widespread is the multi-level model, in which security is ensured sequentially at the physical, network, and application layers.

• The physical layer is responsible for protecting the server infrastructure: controlled access to technical premises, video-surveillance systems, alarms, and organizational measures for admitting employees and contractors.

• The network layer is provided by firewalls, intrusion-detection systems, VPN connections, and the encryption of network traffic; multi-factor authentication is mandatory for remote connection to 1C databases

• The application layer is oriented directly toward business logic: the correct configuration of roles and rights, protection against SQL injection, the secure development of 1C configurations, and the consistent application of the principle of least privilege

Backup and, more broadly, recovery mechanisms play an integral role in this scheme: they are precisely what minimize damage in any incident — from a hardware failure to a successful attack. The factor of staff training is no less significant: incident statistics consistently show that a substantial proportion of information-security breaches are associated not with sophisticated targeted attacks but with errors or negligence on the part of employees (Table 2).

Designing a methodology for protecting a 1C database at an enterprise is one of the central tasks within the broader scope of managing corporate information resources. Its successful implementation requires simultaneously taking into account technical and organizational aspects and relying on the classical principles of information security

The basic element of the methodology is a set of data-protection principles whose observance increases the system's resilience to potential threats. The first and perhaps most significant of them is confidentiality — restricting access to information to a circle of specially authorized persons. In the 1C system, this principle is implemented through the combination of authentication and authorization mechanisms, the configuration of roles and access rights, and record-level access restriction (RLS), which makes it possible to differentiate the visibility of data down to specific table rows.

The second principle is data integrity: information in the database must be kept in a correct, internally consistent state. Its maintenance is ensured by record-versioning mechanisms, verification of the operations performed, and regular backups, which in 1C can conveniently be automated using scheduled jobs, making it possible to restore the database to a working state in the event of an incident.

The third principle is availability: the information system must operate continuously, and any downtime that disrupts the course of business processes should be minimized. This is achieved by maintaining the serviceability of the server equipment, building a fault-tolerant architecture, and using prompt post-failure recovery procedures.

The fourth principle is accounting and auditing. It requires the mandatory recording of the actions of users and administrators in system logs; in the 1C platform, this role is performed by the built-in registration log, which reflects login events, data changes, and operations with access rights. Regular analysis of these logs makes it possible to notice deviations from the usual picture of work and to recognize potential incidents before they escalate into serious ones.

The fifth principle is the minimization of privileges. According to it, a user should have exactly the set of privileges necessary to perform their job duties — no more and no less. Any excessive rights turn into a potential entry point for an attacker or a source of unintentional error.

Finally, the principle of protection against threats covers the arsenal of directly technical means: antivirus suites, firewalls, intrusion detection and prevention systems (IDS/IPS), as well as the physical protection of the premises housing the server equipment.

Measures to improve users' digital literacy are also among the mandatory components of the methodology: without sufficient staff competencies, the effectiveness of even the most carefully designed technical solutions is noticeably reduced.

One of the core components of protection is authentication — the procedure for confirming a user's identity when logging into the system. The 1C platform natively supports password protection; additionally, biometric methods and two-factor authentication (2FA) may be used. Passwords must meet strength requirements and be changed periodically

Two-factor authentication provides an additional barrier: to confirm their identity, the user must present two independent factors. The general scheme of its operation is shown in Figure 1.

Two-factor authentication scheme in 1C

DOI:10.60797/IRJ.2026.170.50.3

Открыть в полном размереСкачать рисунок

Two-factor authentication is based on a combination of factors of three different types: something the user knows (login and password), something they possess (a smartphone or a hardware token), and something that characterizes them (a fingerprint, an iris pattern, or facial features). The login scenario is structured as follows. The user enters their credentials, and the system checks their correctness. If the data are correct, a one-time confirmation code is sent to a previously registered device; if not, the user receives an error notification. The system compares the entered code with its reference value. On a match, it grants access to the database; on a mismatch, it records a failed attempt; after three consecutive unsuccessful attempts, the account is temporarily locked.

After authentication, authorization comes into effect — the mechanism that determines which actions are permitted to a particular user

The protection system must also include a monitoring and auditing loop aimed at detecting suspicious activity. SIEM platforms have proven themselves well in this role: they collect events from many sources in real time, correlate them, and signal anomalies. No less important is the organization of secure log storage, which ensures the immutability of the recorded entries and thereby their evidentiary value. Incident-response procedures are built on monitoring data, covering the identification of an event, the collection of initial information, the temporary restriction of access, the elimination of the root cause, and the subsequent restoration of normal system operation.

The effectiveness of a security strategy is ultimately determined by the quality of interaction among the IT service, information-security specialists, and the organization's management. Forming an appropriate corporate culture and providing systematic staff training strengthen the system's resilience to external influences and noticeably reduce the overall level of risk.

Verifying the operability and effectiveness of the developed methodology is the final but by no means formal stage of the study. It is at this stage that it becomes clear how applicable the proposed solutions are under conditions as close as possible to real operation, and which of them require refinement. So as not to put the enterprise's working system at risk, all experiments are conducted in a specially prepared test environment isolated from production.

The aim of testing is to obtain a well-rounded assessment of the effectiveness of the proposed measures as applied to a 1C database across several groups of indicators: resilience to external and internal influences, data integrity, stability of operation, and ease of administration. The initial system configuration without the proposed protection measures is taken as a baseline for comparison, which makes it possible to assess precisely the contribution of the methodology. The test environment should replicate the configuration of the enterprise's real IT infrastructure while remaining isolated from the production environment. The most successful solution is a virtualized server platform with an up-to-date copy of the working 1C database deployed on it, on which characteristic attacks and abnormal situations are reproduced according to controlled scenarios corresponding to the threat types of the STRIDE model.

The testing process is structured in three sequential stages:

1. Functional verification — checking the operability of all components included in the methodology. At this stage, the correct operation of the authentication, authorization, backup, cryptographic-protection, and monitoring mechanisms is verified.

2. Load testing — measuring the performance and stability margin of the system as the number of simultaneous users grows, the flow of transactions increases, and typical queries become more complex.

3. Assessment of the ergonomics of administration and user work — collecting feedback from IT specialists and ordinary users through surveys, interviews, and comparison with the system's operation logs.

Upon completion of all three stages, the results are brought together, interpreted, and formalized as an analytical report.

Following the testing procedure described above, the data obtained were subjected to analytical processing. Among the strengths of the developed methodology are its ability to suppress unauthorized-access attempts and to reduce the system's susceptibility to user errors; the obvious costs include increased server load, the need for additional staff training, and a certain complication of administration.

Validation was carried out over two months on a copy of the organization's working 1C database, which made it possible to assess the effectiveness of the methodology under conditions as close as possible to the working environment. The key indicators recorded were the proportion of blocked unauthorized-access attempts, the average incident-response time, and the average system response time during typical operations; all values were compared with the initial configuration taken as the baseline. To obtain reproducible estimates, a fixed battery of 500 simulated unauthorized-access attempts spanning the six STRIDE threat categories was replayed in ten independent test runs against both the baseline configuration and the system protected by the proposed methodology, and the figures reported below are averaged over these runs. The share of successfully blocked unauthorized-access attempts rose from 52 ± 3% in the baseline configuration to 97 ± 1% with the proposed measures in place — that is, a relative increase of about 87% (an absolute gain of roughly 45 percentage points). The average incident-response time was reduced from 14 to 4 minutes. For typical user operations, the average response time increased by 6–9% depending on the type of operation (on average, from 0.45 to 0.49 s) — an increase that falls within the acceptable range and is practically imperceptible to users in everyday work. The tests confirmed the effectiveness of the combined approach that brings together multi-factor authentication, backup, monitoring, and auditing. At the same time, the connection of cryptographic mechanisms predictably increased the server load, which required additional configuration optimization. The resulting balance between the increase in security and the moderate decrease in performance makes it possible to recommend the methodology for implementation in the enterprise's production environment.

The practical implementation of a 1C database protection methodology is perhaps the most critical part of the entire effort: it is here that theoretical constructs collide with the reality of the enterprise, and the effectiveness of the proposed measures is entirely determined by the accuracy of their execution. Implementation is not only the installation and configuration of technical means but also systematic work with people, forming within the team a culture of secure handling of information. The starting point is a diagnosis of the current state of the protection system: an audit of existing regulations, an inventory of the tools used, the identification of bottlenecks, and a check against regulatory requirements. The resulting picture becomes the basis for a list of the necessary technical and organizational improvements.

Next, a detailed implementation plan is drawn up: stages are identified, deadlines are stipulated, and areas of responsibility are distributed among the project participants. A responsible person is appointed for each key area — technical administration, monitoring, training, and oversight of regulation compliance. After this, the technical part proper begins: updating the applied solutions, deploying additional protection tools, configuring monitoring tools, updating software, and introducing data-recovery procedures. All work is carried out sequentially and in a coordinated order, which makes it possible to avoid prolonged downtime and to reduce the risk of disrupting normal system operation.

A special place in implementation is occupied by staff training: the level of security is directly related to the discipline of following the rules. The training program combines theoretical and practical parts. For technical specialists, the emphasis is on the intricacies of administration, security issues, and the procedure for responding to incidents; for ordinary users, on the rules of safe work, the creation of strong passwords, the recognition of forged messages, and the prevention of information leaks. The formats can vary: lectures, seminars, online courses, workshops, and a concluding test. After formal training, it is advisable to deploy a consulting-support system — it allows employees to promptly obtain clarifications on emerging questions and not to accumulate unresolved problems.

For greater clarity of the development and implementation of security policies, the entire process is formalized as a flowchart that records the order in which the training and regulatory measures are carried out (Figure 2).

Flowchart of security policy development and implementation

DOI:10.60797/IRJ.2026.170.50.4

Открыть в полном размереСкачать рисунок

The process of implementing the information-security methodology itself is conveniently represented as a sequence of steps unfolding over time. It begins with the launch of a formal implementation procedure and the development of a security policy, within which the list of current threats is outlined and the requirements, access rules, the procedure for handling data, and response measures are recorded. The prepared package of documents is agreed upon with management, after which responsible persons and their functions are assigned. This is followed by training events that conclude with a check of staff knowledge; if the results are unsatisfactory, the training cycle is repeated. Once the plan is approved, a working group is formed — it includes information-security specialists, 1C administrators, and representatives of the departments that use the system. On this basis, work regulations and detailed instructions on access, backup, authentication, and monitoring are developed.

Next comes the turn of technical work: cryptographic mechanisms are selected and configured, the rights-differentiation and authentication system is set up, monitoring with log keeping is deployed, and a schedule for software updates and testing is drawn up. In parallel, the vulnerability-auditing procedure and the incident-response order are refined, and staff training is conducted. Each block of measures — technical and organizational — must undergo testing followed by the collection of user feedback, which makes it possible to adjust the implementation process in a timely manner.

After all elements of the methodology have been deployed, the task of continuously monitoring its effectiveness becomes critically important. This includes analyzing access logs and system events, conducting periodic penetration tests, assessing the clarity and convenience of the regulations for employees, surveying users and administrators, and checking against current standards and regulatory requirements. The assessment scale should be two-dimensional: quantitative indicators (the proportion of blocked unauthorized-access attempts, the average incident-response time, the average system response time) should be complemented by qualitative ones — staff satisfaction and the degree of actual compliance with the established rules.

Thus, the implementation of the methodology is not a one-time campaign but a multi-stage and recurring process that requires consistency of action and constant oversight. For the result to be sustainable, the effectiveness of the measures applied must be regularly reviewed and the methodology promptly adapted to changes in the technological landscape and the emergence of new threats.

The study conducted on the topic "A Multi-Level Data Protection Methodology for 1C Information Systems" made it possible to formulate and validate a set of theoretical propositions and practical solutions aimed at improving the reliability of storing and processing corporate data. A review of existing approaches showed their strengths and weaknesses and, most importantly, revealed an obvious gap: the insufficient adaptation of typical methods to the architectural features of the 1C platform.

All the stated tasks have been solved. A critical review of current protection methods was carried out and the actual level of data security in a typical 1C administration scenario was assessed; their strengths and weaknesses, as well as their characteristic residual risks, were identified; a comprehensive methodology combining organizational, technical, and educational measures was formulated; its testing and validation were conducted under conditions modeling real operation; and practical recommendations and a regulation suitable for implementation at an enterprise were prepared.

It has been established that ensuring data security in 1C administration is impossible without a comprehensive approach that combines technical, organizational, regulatory, and educational measures. In the course of development, the key elements of protection were identified: the differentiation of access levels, the creation and storage of backups, the use of encryption, and tools for monitoring and incident response. Particular attention was paid to the principles of authentication, authorization, and control of user actions.

The practical part of the work included testing and validation of the developed methodology under conditions modeling a real operating environment. The results obtained are convincing: the share of successfully blocked unauthorized-access attempts rose from 52% to 97% (a relative gain of about 87%), the average incident-response time was reduced from 14 to 4 minutes, while the increase in the average response time was only 6–9%. Taken together, the implementation of the proposed measures appreciably reduced the probability of data loss, integrity violations, and unauthorized access to data.

The final stage of the study was the implementation of the methodology in the enterprise's operations — with the preparation of regulatory documents, staff training, and the deployment of a monitoring and control system. This stage demonstrated an essential point: information security is inextricably linked not only with technology but also with the human factor. Forming a culture of secure behavior among users and an awareness of their own responsibility is not a declarative but a key element of a sustainable protection system.

In the end, the developed methodology represents a holistic, practically applicable solution that makes it possible to adapt existing security mechanisms to the specifics of administering 1C databases. Its theoretical significance lies in systematizing the multi-level approach as applied to this platform, and its practical significance in the availability of a proven regulation ready for implementation. It should be borne in mind that validation was carried out at a single organization, so further verification of the methodology on various configurations and in different industries remains a separate task; nevertheless, the work done confirms its relevance amid the growth of cyber threats and the tightening of requirements for protecting corporate information resources.

To further improve the protection system, the authors consider it advisable:

1) to conduct regular audits of the state of information security and to promptly update the methods used;

2) to maintain a high level of staff competencies through systematic training and practical exercises;

3) to introduce modern technological solutions and automated control tools that meet the requirements of industry and state standards.

Ensuring the security of 1C databases is not a task with a one-time solution but a continuous process based on a comprehensive approach, the ability to adapt to new threats, and the constant improvement of the tools and procedures applied.