Cyber Hygiene in Ukraine's Public Sector: Metrics and Progress 2022-2024

Cyber hygiene refers to the routine security practices that organizations and individuals maintain to keep systems and data safe—analogous to physical hygiene practices that prevent disease. Core cyber hygiene practices include maintaining current software patching, using strong unique passwords with a password manager, enabling multi-factor authentication, regularly backing up critical data, and applying network access controls. Ukraine's public sector has undergone a measured but significant cyber hygiene improvement since 2022, driven by a combination of policy mandates, technical assistance from international partners, and the immediate security motivations created by active conflict conditions.

Baseline Conditions in Early 2022

Ukraine's public sector cyber hygiene baseline at the start of the full-scale invasion in February 2022 reflected the general state of government cybersecurity in a middle-income country with recent but incomplete modernization. A significant fraction of government systems ran Windows 7 (which reached end-of-support in January 2020) or older versions. Multi-factor authentication was not mandatory for government systems and was implemented inconsistently. Password policies were enforced unevenly, with audits finding significant prevalence of weak or default passwords in local government systems. Security patching was inconsistent particularly in regional and local government entities that lacked dedicated IT staff.

This baseline meant that many of the Russian cyber operations early in the conflict found that basic network hygiene deficiencies—unpatched systems, weak credentials, absent MFA—provided easy initial access vectors. The response to these findings accelerated an ongoing digital transformation program, with international support adding resources and urgency to the hygiene improvement effort.

Key Cyber Hygiene Metrics

Password Manager Adoption in Government

Password manager adoption in Ukraine's public sector was below 5% at the start of 2022—consistent with low adoption globally among non-technical users. SSSCIP's 2022 Emergency Cyber Hygiene Orders mandated that central government IT departments evaluate and deploy password management solutions, with Bitwarden for Enterprises (available with government discount through international assistance programs) and KeePass (open-source, free) identified as approved options for government use.

By late 2023, adoption had reached approximately 20% of central government employees, driven by IT department-initiated rollouts rather than individual employee initiative. User resistance—particularly among older workers unaccustomed to password manager workflows—remained a barrier. Training on password manager use was incorporated into mandatory quarterly security awareness training modules starting in Q2 2023, contributing to improved adoption rates. Reaching the 35% target requires sustained change management effort beyond mandatory policy alone.

Multi-Factor Authentication Coverage

MFA adoption in Ukraine's government accelerated from mandates issued by SSSCIP in March and April 2022, requiring MFA on all email accounts and VPN access for central government employees within 60 days. Microsoft's Government Security Program for Ukraine provided access to Azure Active Directory Premium licenses enabling conditional access and MFA policies across government Microsoft 365 tenants at no cost, removing cost as a barrier. Google's security team provided direct technical assistance for government entities using Google Workspace.

Despite policy mandates, full MFA coverage has been limited by account provisioning gaps (former employees whose accounts were not properly de-provisioned), service accounts (programmatic accounts used by applications that cannot interactively complete MFA challenges), and local government entities outside the central government mandate scope. The ~26% of central government accounts still lacking MFA coverage by late 2023 represented primarily these categories rather than active refusal by individual employees.

Unpatched Systems Reduction

Ukraine's patch management improvement was driven partly by migration from on-premises systems to cloud services—Microsoft Azure and Microsoft 365 cloud services automatically apply Microsoft-managed security patches, removing the patching burden from government IT staff. For on-premises systems, SSSCIP's vulnerability scanning program (using Tenable Nessus, donated with partner support) established a baseline of critical vulnerability prevalence across central government systems. Detected critical vulnerabilities published in the CISA Known Exploited Vulnerabilities (KEV) catalog were prioritized for mandatory 72-hour remediation, while other critical vulnerabilities received 30-day targets.

Security Scorecards and External Assessment

Ukraine adopted security scorecard tracking through SecurityScorecard and Bitsight platforms—external assessment tools that measure an organization's externally observable security hygiene indicators including open ports, SSL certificate issues, exposed services, and IP reputation. SecurityScorecard provided free access to Ukrainian government entities as part of its crisis response program. These external scorecards enabled SSSCIP to benchmark government ministry performance against each other and against international peers, and provided donors and international partners with independent verification of hygiene improvement over time.

FAQ

Why is cyber hygiene still treated as a significant challenge in 2024?

Despite significant improvement since 2022, cyber hygiene remains a challenge because the scale of Ukraine's public sector (hundreds of ministries, agencies, regional and local governments, state-owned enterprises, and critical infrastructure operators) means even a small percentage of non-compliant entities creates significant attack surface. Additionally, wartime staff turnover—experienced IT staff being mobilized for military service, replaced by less experienced personnel—creates recurring baseline capabilities gaps that require ongoing effort to address.

How does password manager deployment typically proceed in a large organization?

Successful enterprise password manager deployments typically follow a phased approach: IT administrators and high-privilege accounts in the first phase, followed by all employees in security-sensitive departments, then company-wide rollout. Key success factors include mandatory training before deployment (explaining why and how to use the tool), a designated help desk contact for password manager issues, pre-loading commonly used work credentials to demonstrate immediate value, and clear policy that password managers are the approved method for managing work credentials. Forcing password complexity requirements simultaneously incentivizes adoption.

What percentage of Ukrainian government systems are still running end-of-life operating systems?

SSSCIP estimates that approximately 15% of central government workstations were running end-of-life Windows versions (primarily Windows 7 and Windows 8.1) as of late 2023, down from approximately 35% at the start of the war. Regional and local government percentages are higher—estimates suggest 20-30% in some regions. The main barriers to migration are legacy applications that require older operating system versions to function correctly and budget constraints for hardware upgrades when older systems cannot run current Windows versions.

How do security scorecards measure cyber hygiene externally?

Security scorecard platforms measure observable indicators from outside an organization's perimeter: open ports and services visible on internet-facing systems, SSL/TLS certificate validity and configuration quality, IP address reputation (indicating whether organization IP ranges have been associated with malicious activity), exposed application vulnerabilities detectable through passive scanning, evidence of data breaches in breach databases, and patching cadence based on version information visible in application banners. These metrics capture the externally observable attack surface rather than internal hygiene, and correlate with but do not fully represent the complete internal security posture.

What is the single most impactful cyber hygiene improvement for Ukrainian public sector?

Among available hygiene improvements, comprehensive MFA deployment provides the highest security-to-effort ratio for Ukraine's public sector. Microsoft research based on enterprise telemetry indicates that MFA blocks approximately 99.9% of account compromise attacks. Given that credential phishing and password spraying are among the most common initial access techniques used by Russian APT groups against Ukrainian targets, eliminating the effectiveness of these attacks through universal MFA would prevent a high proportion of successful intrusions. SSSCIP guidance consistently identifies MFA completion as the top priority cyber hygiene action for entities that have not yet achieved full coverage.

Sources

1. SSSCIP — "Ukraine Cybersecurity Status Report 2023," cip.gov.ua
2. Microsoft — "Government Security Program: Ukraine Support Report," microsoft.com 2023
3. SecurityScorecard — "Ukraine Government Security Scorecard Report," securityscorecard.com 2023
4. CISA — "Known Exploited Vulnerabilities Catalog," cisa.gov/known-exploited-vulnerabilities-catalog
5. USAID — "Cyber Security for Critical Infrastructure in Ukraine (CCIS) Program: Phase II Results," usaid.gov 2024