Modern Ukrainian business operates under unprecedented cyber threats, where attacks are becoming increasingly intense and even synchronized with physical strikes. The ability to maintain the integrity of automated business processes and their data during the active phase of a cyberattack in cloud environments is not just a matter of resilience, but a critical condition for survival and the preservation of the legal validity of operations. The transition to cloud solutions, while providing flexibility and scalability, requires a rethinking of cybersecurity approaches, especially in the context of unique Ukrainian regulations and threats.
Cyber Threats and Regulatory Requirements in Ukrainian Clouds
The Ukrainian cyberspace is under daily pressure from various attacks. Among the most common threats to businesses are ransomware, phishing, DDoS attacks, malware, supply chain attacks, insider threats, and social engineering. [2, 8, 10, 13, 16, 40] Particularly dangerous are targeted attacks combining multiple vectors, as well as the use of artificial intelligence to create more convincing phishing campaigns and the risks associated with uncontrolled use of AI (shadow AI) within companies. [10, 13, 34]
Ukraine's regulatory framework is actively developing to counter these threats. The key document is the Law of Ukraine "On the Basic Principles of Ensuring Cybersecurity of Ukraine," which defines the legal and organizational foundations for protecting national interests in cyberspace. [3, 9, 11, 12, 14] Since September 16, 2022, the Law of Ukraine "On Cloud Services" has been in effect, regulating legal relations concerning data processing and protection in cloud computing, obliging providers to provide information on protection against cyberattacks. [17, 26] The government has also approved the National Plan for Response to Cyber Incidents, Cyberattacks, and Cyber Threats (Cabinet of Ministers Resolution No. 1533 of November 26, 2025), which harmonizes Ukrainian legislation with the requirements of the EU NIS2 Directive and creates a unified coordination framework for all cybersecurity actors. [25, 28, 36] The State Service of Special Communications and Information Protection (SSSCIP) establishes requirements for the protection of information and communication systems, particularly for providers working with the public sector and critical information infrastructure, applying a risk-based approach. [40, 43]
Architectural Patterns for Ensuring Integrity
To ensure the integrity and continuity of automated business processes during an active cyberattack, the implementation of robust architectural solutions is critically important. Information integrity is defined as a property that guarantees the absence of errors, accuracy, completeness of data, and that changes are made only by authorized persons or processes. [42] Key architectural patterns that contribute to this include immutable logs, isolated process execution environments, and distributed ledgers.
Immutable Logs and Distributed Ledgers: The Foundation of Trust
Immutable logs are a key component for ensuring data integrity. They provide a chronological, unalterable record of all transactions and events, making their hidden deletion or modification impossible. This principle underlies distributed ledger technology (DLT), particularly blockchain. [15, 45]
Distributed ledgers are decentralized databases that store transactions across a network of computers, providing a high level of security and transparency. [15, 19, 21, 23, 24] Key features of DLT, such as decentralization, immutability (due to cryptographic hash functions and consensus protocols), and resistance to a single point of failure, make them extremely effective for protecting data integrity even during active attacks. [21] Each network node has a copy of the ledger, and changes are agreed upon through consensus, making data manipulation by a single attacker impossible. [21]
Isolated Process Execution Environments: Protection During the Active Phase
Isolated process execution environments play a crucial role in limiting the spread of cyberattacks and protecting critical business processes. Network micro-segmentation allows for the division of infrastructure into small, isolated segments, limiting threat movement in case of compromise. [22] The application of the Principle of Least Privilege ensures that each user or process has only the minimum necessary access rights to perform its functions, significantly reducing potential damage from compromised accounts. [22]
For cloud environments, especially those using containerization, ensuring runtime security and preventing "container escapes" is critical. [22] The use of "sandboxes" to isolate potentially dangerous processes, such as AI agents, is effective but requires careful configuration to prevent bypass. [33] Monitoring and controlling all interactions that cross the boundaries of isolated environments is mandatory. [33]
Operational Strategies and Balancing Response with Continuity
Architectural solutions must be complemented by robust operational procedures that enable effective response to cyber incidents while maintaining the integrity and continuity of business processes:
- Multi-Factor Authentication (MFA): Implementing MFA for all critical systems significantly complicates unauthorized access, even if passwords are compromised. [35, 37]
- Regular Updates and Patching: Timely updating of operating systems and software closes known vulnerabilities that are often exploited by attackers. [16, 35]
- Data Encryption: Applying cryptographic technologies to protect data both at rest and in transit minimizes the risks of unauthorized access. [35, 46]
- Backup and Recovery: Regularly backing up critical data and developing disaster recovery plans ensure business process continuity after incidents. [16, 29, 46]
- Personnel Training and Awareness Raising: The human factor is one of the weakest links. Regular training on cyber hygiene, phishing detection, and social engineering is vital. [10, 16, 34, 35]
- Centralized Update Management and Monitoring: Using specialized systems for monitoring, automating updates, and controlling data flows, especially in hybrid infrastructures, ensures visibility and manageability. [34, 35]
- Incident Response Plan: Having a clear, yet flexible, response plan that considers the specifics of Ukrainian legislation (e.g., the National Plan for Response to Cyber Incidents) allows for rapid threat localization, damage minimization, and restoration of operations with minimal integrity loss. [25, 28, 35, 36]
Choosing an Architectural Approach: Comparative Analysis for Ukrainian Business
Selecting the optimal architectural approach for ensuring the integrity and continuity of business processes in Ukrainian clouds during a cyberattack requires careful analysis. Let's consider the effectiveness of three key patterns:
Immutable Logs: This approach is fundamental to ensuring integrity. Its advantage lies in the fact that once recorded, data cannot be altered or deleted, which is crucial for auditing and proving the legal validity of transactions. In the context of Ukrainian regulation, which requires the preservation of information integrity, especially for state information resources and critical infrastructure, immutable logs are a mandatory element. They are effective against ransomware that encrypts or deletes data, as they allow for the restoration of original, uncompromised records. However, immutable logs alone do not ensure process continuity if the systems generating them are disabled.
Isolated Process Execution Environments: This approach focuses on limiting attack propagation. Micro-segmentation and the principle of least privilege allow critical processes to remain functional even if part of the system is compromised. This directly contributes to business process continuity during an active cyberattack, as isolated environments can continue to operate or be restored more quickly. In the context of frequent targeted attacks and supply chain attacks in Ukraine, isolation is key to minimizing impact. However, this approach requires significant investment in design and management, as well as constant monitoring to prevent "escapes" and bypasses of isolation.
Distributed Ledgers (DLT): DLT combines the advantages of immutable logs with decentralization, providing high resilience to failures and attacks. Through consensus mechanisms, data integrity is guaranteed even if individual nodes are compromised, making them extremely effective against ransomware, data manipulation, and DDoS attacks targeting centralized systems. [21] For Ukrainian businesses seeking maximum resilience and legal immutability of critical records (e.g., in the financial sector or for supply chain management), DLT offers a powerful solution. [24] However, implementing DLT is complex and resource-intensive, requires significant expertise, and may have higher operational costs compared to traditional systems.
The optimal strategy for Ukrainian enterprises often lies in a hybrid approach that integrates these patterns. Immutable logs and DLT can be used for critically important data and transactions where integrity is an absolute requirement. Isolated environments will ensure the resilience and continuity of business processes themselves. This approach allows for the necessary balance between response speed, integrity preservation, and continuity assurance, which is key in Ukraine's current cyber landscape.
