Vitaliy Pikov · Expert & lecturer
I help teams build secure software and teach the people behind it. Explore my lectures, practical workshops and resources for everyday engineering.
Different disciplines. One engineering perspective.
An introduction to how I approach security, teaching and practical work.
Why borrowed regulations do not create security: people, tools and processes as the load-bearing triad, evidence as the trace of real work, and documents as an honest projection of the operating system.
Read the lectureA method for local hands-on practice: isolating the Docker target, pinning the version, collecting evidence, classifying challenges, prevention for A01–A06, and report templates.
Open the workshopA systematic review of three documents from FSTEC of Russia (the federal technical and export control service): the 2022 Linux recommendations and the agreed guidance for Astra Linux 1.7 and 1.8.
Open the workshopLectures, courses, practical assignments and references, all in one place.
The website is available in English and Russian. Lecture pages and teaching materials open in Russian.
Try a broader search or clear the filters.
From requirements and architecture to code analysis and the software supply chain.
Why borrowed regulations do not create security: people, tools and processes as the load-bearing triad, evidence as the trace of real work, and documents as an honest projection of the operating system.
Read the lectureHow to write a specification that can actually be built and accepted: GOST 19 and 34 series, atomic requirements and acceptance test programmes.
How to write a specification that can actually be built and accepted: GOST 19 and 34 series, atomic requirements and acceptance test programmes. Secure development under GOST R 56939-2024 as the load-bearing axis — requirements → architecture → threat model → detection → remediation — with SAST/SCA/SBOM/fuzzing artefacts and an acceptance package.
A complete methodology for preparing a security-product vendor for certification against GOST R 56939-2024: a road map, 25 process regulations and plans covering processes 5.1–5.25, a hardened C/C++ compiler…
A complete methodology for preparing a security-product vendor for certification against GOST R 56939-2024: a road map, 25 process regulations and plans covering processes 5.1–5.25, a hardened C/C++ compiler under GOST R 71206-2024, and verification via IDEF0 and AppSec Table Top.
A six-part teaching series: vulnerabilities and secure development, the 25 secure development processes, the requirements of GOST R 56939-2024, process certification under FSTEC Order No. 240, and practical adoption.
Read the lectureA complete teaching day: the secure software lifecycle and extreme programming, the ten layers of a modern technology stack, one task solved in four languages, and an analysis of four security defects with fixes and tests.
Read the lectureA teaching day on language classification and how technology choice affects security, on Shift Left, and on architectural trust boundaries.
A teaching day on language classification and how technology choice affects security, on Shift Left, and on architectural trust boundaries. Lab work: a hardened SQLite schema, CWE-89, parameterised queries, allowlists and the RED → GREEN cycle.
A two-day educational lab: day 1 with a teaching slide deck, 15 original diagrams, a full transcript, a session protocol and lab materials; a glossary of 60+ terms and an instructor's guide; day 2 with the…
A two-day educational lab: day 1 with a teaching slide deck, 15 original diagrams, a full transcript, a session protocol and lab materials; a glossary of 60+ terms and an instructor's guide; day 2 with the programme and a prepared archive structure.
A method for local hands-on practice: isolating the Docker target, pinning the version, collecting evidence, classifying challenges, prevention for A01–A06, and report templates.
A method for local hands-on practice: isolating the Docker target, pinning the version, collecting evidence, classifying challenges, prevention for A01–A06, and report templates. Linked to the open archive of day-one source materials.
Managing the third-party component supply chain: the draft Russian national standard, SBOM in CycloneDX format, and requirements for vulnerability and licence analysis tooling.
Read the lectureThe principles of static code analysis, vulnerability classes (CWE, OWASP), CI/CD integration, Russian and international tooling, and secure development requirements.
Read the lectureThe requirements of process 5.19 in GOST R 56939-2024, simulating attacker behaviour, 11 classes of checks, 6 practical cases and an original 38-point checklist.
Read the lectureA full course on secure development practice beyond fuzzing and static analysis: attack surface, 9 analysis techniques, 6 architecture cases, and building the software component list and submitting it to FSTEC of Russia.
Explore the courseA five-lecture teaching day: security drivers and terminology, the ISO/IEC 27000 family, policy and RACI, the secure lifecycle under GOST R 56939-2024, risk management under ISO/IEC 27005, internal audit under…
A five-lecture teaching day: security drivers and terminology, the ISO/IEC 27000 family, policy and RACI, the secure lifecycle under GOST R 56939-2024, risk management under ISO/IEC 27005, internal audit under ISO 19011, and management review of the ISMS.
227 threats with affected objects and selection rationales: 177 apply to software directly or under stated conditions, while 50 fall outside the defined software analysis scope.
227 threats with affected objects and selection rationales: 177 apply to software directly or under stated conditions, while 50 fall outside the defined software analysis scope. Two coordinated lists with search, filters and CSV export. Content in Russian.
Astra Linux, Windows, hardware security and security tools.
An overview of this special-purpose operating system: the Astra Group product ecosystem, releases, architectures, security levels and the basic interface.
Read the lectureA detailed walk-through of the product line, update numbering and the three security levels — base, enhanced and maximum.
Read the lectureDiscretionary (DAC), mandatory (MAC) and role-based (RBAC) access control, the Bell–LaPadula model, and the architecture of the protection subsystem.
Read the lectureA systematic review of three documents from FSTEC of Russia (the federal technical and export control service): the 2022 Linux recommendations and the agreed guidance for Astra Linux 1.7 and 1.8.
A systematic review of three documents from FSTEC of Russia (the federal technical and export control service): the 2022 Linux recommendations and the agreed guidance for Astra Linux 1.7 and 1.8. Includes workstation and server checklists, 16 sysctl parameters, 6 “spot the flaw” cases and a 32-point readiness checklist.
The architecture of the security subsystem (LSA, SRM, SAM), built-in protection mechanisms, BitLocker and EFS, anti-malware protection and update policy.
Read the lectureVon Neumann principles and the Harvard architecture, side-channel attacks, Spectre and Meltdown, TPM and Secure Boot, and Russian hardware platforms.
Read the lectureAn overview of this Russian SIEM by NPO Echelon, plus hands-on work on a VirtualBox lab: installation on Astra Linux 1.7/1.8, onboarding Windows 10 as an event source, the WMI agent, six national monitoring…
An overview of this Russian SIEM by NPO Echelon, plus hands-on work on a VirtualBox lab: installation on Astra Linux 1.7/1.8, onboarding Windows 10 as an event source, the WMI agent, six national monitoring standards and three practical exercises.
A two-day workshop: vulnerabilities, CVSS v4.0, KEV and EPSS, the vendor landscape, network discovery, asset inventory and Scaner-VS checks; then data remanence, integrity, access rights and Inspector reporting.
Explore the course
Certification, licensing, risk management and critical infrastructure protection.
The regulatory basis of the FSTEC and Ministry of Defence certification systems, the certification procedure, trust levels 1–6 (the FSTEC assurance grades), and development requirements for security products.
Read the lectureObtaining an FSTEC licence: Federal Law No. 99-FZ, Government Decrees No. 79 and No. 171, licence requirements, timelines, and the mistakes applicants typically make.
Read the lectureHow information-protection units are organised: the requirements of Presidential Decree No. 250 and of the FSTEC and FSB, a typical structure, and how such units work with regulators.
Read the lectureA full teaching day from a professional retraining programme: information security risk management (GOST R ISO 31000-2019 and GOST R ISO/IEC 27005-2010); operation of protected systems and of significant…
A full teaching day from a professional retraining programme: information security risk management (GOST R ISO 31000-2019 and GOST R ISO/IEC 27005-2010); operation of protected systems and of significant critical information infrastructure (CII) facilities (Federal Law No. 187-FZ as amended in 2025, FSTEC orders No. 235, 239 and 117, and FSB regulations); planning of information-protection work; and computer incident management (GosSOPKA, the 597XX standards series). Five lectures of 1.5 academic hours, about 100 slides.
A deep dive into the security of critical information infrastructure: threat assessment (the FSTEC methodology of 5 February 2021 and the FSTEC threat database), the intruder model (N1–N4), the structure of a…
A deep dive into the security of critical information infrastructure: threat assessment (the FSTEC methodology of 5 February 2021 and the FSTEC threat database), the intruder model (N1–N4), the structure of a threat model with a worked case, control requirements under orders No. 235 and 239 (including trust levels for security products, database systems and virtualisation), how to select controls with a practical exercise, and vulnerability classification and criticality scoring under the FSTEC methodology of 30 June 2025. Five lectures of 1.5 academic hours, about 115 slides.
Pentesting, fuzzing and static analysis: methods and practice.
An original course on attack methodology and penetration testing: 5 lectures plus a hands-on session on Kali Linux and Metasploitable 2.
An original course on attack methodology and penetration testing: 5 lectures plus a hands-on session on Kali Linux and Metasploitable 2. FSTEC regulation, the FSTEC vulnerability database, Russian tooling, Articles 272–274.1 of the Russian Criminal Code, and the PTES methodology.
A static analysis course aligned with GOST R 71207-2024: the principles of static analysis, hands-on work with PVS-Studio, CI/CD integration, and organising the process under the new standard.
Explore the courseA foundation course on assessing perimeter security, for security managers, auditors and system administrators: the FSTEC regulatory basis, pentest methodologies and Russian tooling.
Explore the courseAn advanced course for practising pentesters, SOC analysts and DevSecOps engineers: 12 modules, OWASP Top 10, reverse engineering, EDR evasion, Active Directory post-exploitation and a final assessment project.
An advanced course for practising pentesters, SOC analysts and DevSecOps engineers: 12 modules, OWASP Top 10, reverse engineering, EDR evasion, Active Directory post-exploitation and a final assessment project. Has its own detailed landing page.
A dynamic-analysis course for security-product developers, certification-body experts and DevSecOps engineers: AFL++, libFuzzer, Sydr-Fuzz, and fuzzing of compiled, web and systems languages under GOST R…
A dynamic-analysis course for security-product developers, certification-body experts and DevSecOps engineers: AFL++, libFuzzer, Sydr-Fuzz, and fuzzing of compiled, web and systems languages under GOST R 56939-2024 (process No. 11).
Information systems design, graduation projects and SPDX licences.
A guide through the term project: conceptual model, ER diagram, normalisation, the physical database, quality review, and the mistakes students typically make.
Explore the course61 slides, 11 thematic blocks, 5 checklists and 10 analyses of the mistakes typically made when choosing and wording a graduation thesis topic.
Read the lectureLiteral translations of the official SPDX licence texts, plus draft verdicts on suitability for commercial projects 🟢🟡🔴 — permissions, conditions and limitations.
Open the referenceA suggested order for building knowledge and putting it to work.
Getting started
Understand assets, threats and risk. Start by mapping the boundaries of a simple information system.
Start with information systemsAdministrators & security engineers
Work through configuration, hardening and monitoring. Check what changed and how to roll it back.
Start with Astra LinuxDevelopers & DevSecOps
Connect architecture, threat modelling, code analysis and software composition with evidence of the result.
Start with secure developmentMy work brings together secure software development, information security and education. I translate requirements into architecture, working processes and checks that teams can use.
For lectures, team training and consulting on secure software development and information security.