Tag Archives: Kaspersky Transparency Center

Kaspersky Selects Malaysia For APAC Transparency Center!

Leave a reply

Kaspersky just announced that they have selected Malaysia as the site for their APAC Transparency Center!

Here is everything you need to know about the third Kaspersky Transparency Center, and why they chose Malaysia.

 

The Kaspersky Global Transparency Initiative

The Kaspersky Global Transparency Initiative began in October 2017, as a way to allay fears that Kaspersky Lab products and services had backdoors built-in.

It was really an extension of Eugene Kaspersky’s offer to show Kaspersky Lab source codes to the US government.

For a more detailed take on the Kaspersky Global Transparency Initiative, we recommend :

 

Kaspersky Global Transparency Initiative APAC Update

The Managing Director for Asia Pacific at Kaspersky, Stephan Neumeier, kicked off the launch with an update on the Kaspersky Global Transparency Initiative, with a focus on the APAC region.

  • Started relocating customer data storage and processing infrastructure for European users from Russia to Zurich, Switzerland, to be completed by the end of 2019.
  • Opened two Transparency Centers in Europe – in Zurich (November 2018) and Madrid (June 2019). The Spanish Center also serves as a briefing center for key company stakeholders.
  • Successfully completed the Service Organization Control for Service Organizations (SOC 2) Type 1 audit. The final report, issued by one of the Big Four accounting firms, confirms that the development and release of Kaspersky’s threat detection rules databases (AV databases) are protected from unauthorised changes by strong security controls.
  • Since announcing the Bug Bounty program’s extension, Kaspersky resolved 66 bugs reported by security researchers and awarded almost $45,000 in bounty rewards.
  • Kaspersky also supports the io framework which provides Safe Harbor for vulnerability researchers concerned about potential negative legal consequences of their discoveries.
[adrotate group=”1″]

 

Why Kaspersky Selected Malaysia For The APAC Transparency Center

Kaspersky revealed that their APAC Transparency Center will be located in Cyberjaya, in partnership with CyberSecurity Malaysia.

Cyberjaya was selected because of its central location and close proximity to many key Kaspersky clients in APAC, as well as other security- and infrastructure-related reasons.

 

What Is The Kaspersky APAC Transparency Center For?

The new Kaspersky APAC Transparency Center in Malaysia will serve as the third trusted code review facility, after Zurich and Madrid.

Government regulators and Kaspersky enterprise clients can request to come to the Kaspersky APAC Transparency Center to examine or review :

  • source code of Kaspersky consumer and enterprise solutions, like Kaspersky Internet Security (KIS), Kaspersky Endpoint Security (KES) and Kaspersky Security Center (KSC)
  • Kaspersky’s threat analysis, secure review and application security testing process
  • all versions of Kaspersky software builds, and AV database updates
  • data feeds that are sent by Kaspersky products to the cloud-based Kaspersky Security Network (KSN)

It will also function as a briefing centre, where guests will be able to learn about Kaspersky’s engineering and data processing practises.

This new Kaspersky Transparency Center is slated to open for its first visitors in early 2020. Like the other Transparency Centers, access is available only upon request.

 

Suggested Reading

Go Back To > Cybersecurity | Home

 

Support Tech ARP!

If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!

The Kaspersky Global Transparency Initiative Explained!

Leave a reply

The upcoming Trump-Putin summit aside, Kaspersky Lab is pushing forward with their Global Transparency Initiative. What is the Kaspersky Global Transparency Initiative? And how does it help guarantee that Kaspersky Lab products and services are safe to use?

We explain it all, with a little help from Stephan Neumeier and Oleg Abdurashitov from Kaspersky Lab!

 

The Kaspersky Global Transparency Initiative

The Kaspersky Global Transparency Initiative began in October 2017, as a way to allay fears that Kaspersky Lab products and services had backdoors built-in.

It was really an extension of Eugene Kaspersky’s offer to show Kaspersky Lab source codes to the US government.

July 2017 : Eugene Kaspersky Offers Source Codes To US Government

In response to the US government’s prohibition on the use of Kaspersky Lab products, Eugene Kaspersky offered to make Kaspersky Lab source codes available to the US government for inspection.

Oct. 2017 : Source Codes Available For Inspection

In the initial version, Kaspersky Lab offered to :

  • make their source codes available for independent review and evaluation,
  • conduct an independent assessment of their software development and supply chain,
  • establish three Transparency Centers in Asia, Europe and the US.
  • increase bug bounty awards to US$100,000

We immediately pointed out that it did not address a major concern of the US government – that data is still being routed through Russian Internet service providers that are subject to the Russian intelligence surveillance system called SORM (System of Operative-Investigative Measures).

Kaspersky Lab maintained that customer data sent to their Russian servers are encrypted, and they do not decrypt them for the Russian government. But it would be impossible for them to prove that to anyone’s satisfaction.

May 2018 : Core Operations Moves To Switzerland

Last month, Kaspersky Lab announced that they are establishing a data center in Zurich by the end of 2019. This facility will store and process all information for users in Europe, North America, Singapore, Australia, Japan and South Korea, with more countries to follow.

The Kaspersky Switzerland facility will :

  • store and process customer data of select countries outside of Russia
  • host Kaspersky’s software build conveyer that will assemble and digitally-sign the final executable files and updates
  • serve as the first Kaspersky Transparency Center.

In addition, Kaspersky will be arranging for a qualified and independent third-party to review and supervise the data storage, processing, software assembly and source codes at this Zurich facility.

The very act of moving their customer data out of Russia to a neutral country finally removes our main criticism of their initial transparency initiative. Now, no one has to worry about sensitive data being transmitted through the Russian SORM intelligence surveillance system.

 

The Kaspersky Global Transparency Initiative Going Forward

The establishment of the Swiss datacenter is merely another phase in the long process of “earning trust”, as Stephan Neumeier called it. Eventually, customer data from most countries outside of Russia will move to that datacenter.

By the end of 2018, all Kaspersky Lab products and threat detection rule databases (AV databases) will be assembled and signed with a digital signature in Switzerland, before being distributed to customers worldwide. All newly assembled software will also be verified by an independent organization, certifying that software builds and updates received by customers match the source code provided for audit.

The next step would be the establishment of two more Transparency Centers – one in Asia, and another one in North America. Singapore and Canada are probable favourites.

 

Perhaps A Backdoor Bounty?

We would suggest that perhaps Kaspersky Lab should establish an independent backdoor bounty program, separate from their current bug bounty.

A large sum of money could be placed in escrow, under an independent and competent third-party, which can freely investigate and reward security researchers who can successfully prove the existence of a backdoor in any Kaspersky product or service.

That would go a long way into shoring up trust of those who have neither the financial nor the technical capabilities to visit a Kaspersky Transparency Center and peruse millions of lines of code.

 

Suggested Reading

Go Back To > Cybersecurity | Home

 

Support Tech ARP!

If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!