Modern methods of protection against cyber attacks and social engineering in Kazakhstan

The cyber threat landscape in Kazakhstan is changing dynamically: the development of e-government (eGov) and the fintech sector has led to an increase in targeted attacks, the use of AI by criminals, and sophisticated social engineering techniques.

1. The current cyber threat landscape • Social engineering and deepfakes: Telephone fraud on behalf of the banking sector or law enforcement agencies, phishing calls using AI-generated voices, as well as phishing in messengers (Telegram, WhatsApp). • Attacks on critical infrastructure (CII) and the public sector: DDoS attacks, ransomware, and compromise of user credentials.
2. Technical protection methods Kazakhstani enterprises and government agencies are actively implementing proactive approaches to cybersecurity: • Zero Trust Architecture: The principle of "don't trust anyone, always check." Access to resources is provided strictly as needed and is constantly validated. • Monitoring Centers (SOC) and SIEM/XDR systems: Round-the-clock collection and analysis of logs for automatic detection of anomalies in real time. • AI Analytics and Threat Hunting: The State Technical Service (JSC GTS) and commercial SoCs use machine learning algorithms to identify vulnerabilities and prevent threats from being blocked. • Mandatory two-factor authentication (2FA): Implementation of biometrics, Push notifications, and hardware keys to protect eGov accounts, banks, and internal systems.
3. Countering social engineering Protection method Implementation mechanism Cyber Hygiene & Awareness Training Regular trainings for employees and simulations of phishing attacks in companies. Stop loan (eGov.kz ) A public service for voluntary refusal to receive bank loans and micro-loans to protect against fraudsters. Anti-phishing platforms Implement WAF (Web Application Firewall) and mail gateways with AI filters that recognize fake links and compromised attachments. Verification of counterparties and calls Using number identification services and end-to-end encryption in corporate messengers.
4. Legislative and state level In Kazakhstan, cybersecurity regulation is coordinated by JSC GTS (KZ-CERT Service), the National Security Committee of the Republic of Kazakhstan and the Ministry of Digital Development. The main measures include strengthening control over personal data leaks (encryption and masking) and regular auditing of information systems according to the Unified Information Security Requirements (ETIB) standard. Effective cyber defense today is based on a combination of modern AI technologies, strict regulatory standards and, most importantly, continuous user training in competent digital hygiene.