Cybersecurity. How Kyrgyzstan is building protection against digital threats

At the international PLAS-forum Digital Kyrgyzstan, experts discussed how technology is changing compliance control, what threats artificial intelligence poses, and how to manage risks. Representatives of banks, educational platforms, and service companies shared which solutions work and which create new problems.

Lira Omurbeкова, Director, Training Center of the State Financial Intelligence Service under the Ministry of Finance of the Kyrgyz Republic

Over the last 10–12 years, the system for combating money laundering in Kyrgyzstan has undergone significant changes. If previously financial institutions and state bodies focused on detecting crimes that had already been committed, today control begins at the moment a client is just considering entering a financial institution and continues until all business relationships are fully concluded.

The growth of technology and digitalization has played a key role in this. Artificial intelligence, on the one hand, helps compliance specialists identify risks, and on the other, creates new threats to the country's financial and national security. Moreover, compliance functions have expanded significantly. If previously the focus was exclusively on combating money laundering, specialists are now responsible for AML, sanctions, environmental, and corruption compliance. Modern approaches must cover not only banks and financial organizations but also virtual assets and state structures.

With the development of technology, new methods of money laundering and terrorist financing are emerging, placing additional pressure on compliance specialists. Today, they must not only identify risks but also possess competencies in risk management, logistics, and cybersecurity. According to statistics, 99% of financial crimes are committed using digital technologies, making cyber threats a key challenge for the entire financial monitoring system.

Kyrgyzstan has already implemented a unique system for training financial security specialists, which has no analogues in Central Asia and the Eurasian region. The state center develops a full cycle of training: from basic courses to certification and professional development. If such initiatives were absent 10 years ago, since 2019, financial security issues have been included even in school curricula. For example, students in grades 10–11 study the basics of financial literacy and learn to recognize fraudulent schemes, and some banks have introduced debit cards for teenagers so they understand the responsibility for financial transactions.

Law enforcement agencies have recorded an increase in the number of teenagers involved in criminal schemes. To counter this, republican olympiads on financial security among schoolchildren and students are held in Kyrgyzstan. About 70% of the winners of these competitions subsequently choose a career in the compliance field. Such specialists are already being trained at six universities in the country, and graduates work in banks, crypto exchanges, and insurance companies. Educational programs cover not only finance and monitoring but also information security, analytics, law, and international relations. 

National and international seminars, as well as professional development programs, are conducted to maintain a high level of specialist training. However, the personnel issue remains critically relevant. The outflow of compliance specialists is high: they work for a year and a half and then leave for companies with more attractive conditions. To solve this problem, a professional standard for financial monitoring specialists is being developed in Kyrgyzstan. Its implementation at the national level will help form a sustainable system for training personnel and increase the country's level of financial security.

Anar Narynbek kyzy, Head of Information Security Department, FINCA Bank

Why manage risks? It may seem like something methodological, complex, and related to paperwork, but everything is built on risk management. For example, this is what the "Day of the Head of IS" catalog looks like. When I was offered this position, I initially refused—I thought I wouldn't sleep at night. But an instrumental approach allows you to manage priorities, focus on real tasks and threats, build a model oriented toward development, rather than just reacting to incidents. Without a risk-oriented approach, the department's work is reduced to responding to reports and incidents.

The second important point is the risk appetite approach. It allows you to see the future, understand which risks should be reduced. The main task of the information security department is to minimize information security risks to an acceptable level and help the business do so. If we have tools, we can explain to the business, in its own language, what measures have been taken and how much the risks have been reduced.

There are many regulatory requirements and standards. The main ones are the National Bank's requirements for the information security of commercial banks. In 2021, a chapter on the social mechanism was added, emphasizing the importance of risk prevention. The Data Protection Agency has also approved a risk assessment methodology.

I recommend three key standards:

ISO — internet management, main stages

NIST — detailed technical aspects

COBIT — recommendations for planning and documentation.

In practice, risk management goes beyond standards. It is important to conduct an inventory not only of information assets but also of all business processes, systems, projects, and technologies. Next, risks are assessed: registries, impact on the business, regulatory requirements, criticality, and incident reports are analyzed. Based on this, a picture of possible threats is formed.

Next, controls are established—organizational and technical measures that can be preventive and detective. A strategy for working with residual risks is selected. Monitoring is a continuous activity that allows you to assess current threats and the need to strengthen control. Key Risk Indicators (KRIs) are key risk indicators. Ignoring such risks can paralyze the business, so they receive special attention. They are tracked by metrics and incident reports. 

It is no less important to assess risks associated with third parties—partners and suppliers. Even if you have a well-established internal system, external risks can affect the company. Currently, questionnaires, document requests, and negotiations are practiced. This is not about filtering out, but about being ready for possible threats. Risks can vary—from data leaks to system outages.

Risks associated with artificial intelligence are assessed similarly: classification of systems, data analysis, threat identification. For banks and companies working with AI, key risks are leaks, attacks, and data compromise. By assessing their impact, appropriate protection measures can be chosen.

The approach is always the same: analysis, information gathering, understanding processes. The better you know what is happening, the more effectively you can manage risks and help the business.

Meruert Kenzhebekova, Director of Cyber Formula 3, Kazakhstan

We have been working with the education sector for about 10 years, and upon seeing the problem in the modernization of the IT sphere, we decided to offer our own solution. 

We are implementing cyber classes in schools and colleges in Kazakhstan. Our goal is to create a new generation of specialists who will be competitive in the global market and make technology accessible to every child, regardless of whether they study in a rural school, an inclusive class, or a city school. 

The main problem is the shortage of trained personnel. Teachers are not IT specialists, but they can teach children artificial intelligence, programming, and cybersecurity. We solved this problem by training teachers and supporting them throughout the year.

In the past, few people took into account the individual abilities and interests of children. Our approach is aimed at identifying their strengths and developing their potential. Even in homework, there is a choice: shoot a video for TikTok or create your own project. This makes learning more interesting and motivating.

We bridge the gap between theory and practice, making learning as practical as possible. Unlike classic computer science lessons, we have no rote learning—only practice. The skills children acquire can be applied in real life.

Why is it important to talk about AI in education? Already 50% of professions require its use, and this figure is growing. AI will not replace lawyers, but a specialist who masters AI will be in higher demand. Technologies also contribute to inclusion, helping people with disabilities. It is also encouraging to see the growing number of girls in IT.

Another problem is the shortage of personnel. We create cyber classes in state schools and colleges, not partnering with private schools. Our Cyber Formula 3 combines space, technology, and methodology. Children should immediately understand that they have entered the world of IT, and the equipment must meet modern standards.

The methodology covers artificial intelligence, programming, and cybersecurity, including three levels: beginner, intermediate, and advanced. Students try themselves in different roles: analysts, neural network developers, cybersecurity specialists. Learning is built on gamification and practice—children create games, websites, find vulnerabilities, and protect data.

Digital security is a key aspect. We teach children how to protect against cyberattacks, phishing, and online threats, and we also conduct training for parents.