Kaspersky banned from US govt systems
The US Department of Homeland Security (DHS) has given US government agencies and departments just 90 days to remove all Kaspersky Labs products from their systems.
The Binding Operational Directive, issued on 13 September by Acting Secretary of Homeland Security Elaine Duke, tasks “departments and agencies to take actions related to the use or presence of information security products, solutions, and services supplied directly or indirectly by AO Kaspersky Lab or related entities”.
The directive calls for “departments and agencies to identify any use or presence of Kaspersky products on their information systems in the next 30 days, to develop detailed plans to remove and discontinue present and future use of the products in the next 60 days, and at 90 days from the date of this directive, unless directed otherwise by DHS based on new information, to begin to implement the agency plans to discontinue use and remove the products from information systems”.
The DHS cited “information security risks presented by the use of Kaspersky products on federal information systems”, specifically:
- Antivirus products and solutions that provide broad access to files and elevated privileges on the computers on which the software is installed, which can be exploited by malicious cyber actors to compromise those information systems.
- Concern about the ties between certain Kaspersky officials and Russian intelligence and other government agencies, and requirements under Russian law that allow Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks.
- The risk that the Russian government, whether acting on its own or in collaboration with Kaspersky, could capitalise on access provided by Kaspersky products to compromise federal information and information systems.
The DHS said that while the action involves products of a Russian-owned and operated company, “the Department will take appropriate action related to the products of any company that present a security risk based on DHS’s internal risk management and assessment process”.
The DHS has given Kaspersky the opportunity to submit a written response addressing the concerns or to mitigate those concerns.
Strategies for navigating Java vulnerabilities
Java remains a robust and widely adopted platform for enterprise applications, but staying ahead...
Not all cyber risk is created equal
The key to mitigating cyber exposure lies in preventing breaches before they happen.
How AI can help businesses manage their cyber risks
Artificial intelligence can be a powerful ally in the fight against cyberthreats.
