Germany’s Federal Office for Information Security has today issued a warning against using the Kaspersky antivirus products. This is due to Kaspersky’s association with the Russian government, impacting its credibility.
Today’s bulletin comes after Russia threatened NATO and the EU in their involvement in the ongoing war with Ukraine. While the companies are advised to replace Kaspersky AV with non-Russian alternatives, Kaspersky responded to this warning and said Germany’s decision is based more on political ground, rather than their products’ technical assessment.
Germany Advises Dumping Kaspersky AV
Last week, Russia has publicly threatened the EU and NATO nations in interfering in their ongoing war with Ukraine, to face harsh consequences if did. This led many to cut ties with the country, including Germany. Today, Germany has made a step forward in advising all its companies against using Kaspersky products.
Kaspersky is a popular antivirus software company running since the late 1990s and is based in Moscow. And this simple origin connection has now diminished the company’s credibility amidst Russia’s war with Ukraine.
Germany’s Federal Office for Information Security (BSI) today issued a warning to all its companies against using Kaspersky AV products. This is because the company’s antivirus software has higher-level privileges on Windows systems it’s run.
These results in maintaining a permanent, encrypted, and non-verifiable connection to the clients’ servers for constant virus checkups. And Germany was concerned these roots can be manipulated by the Russian government to launch cyberattacks against Kaspersky’s clients.
Further, there’s a chance that Kaspersky can be forced to exfiltrate sensitive files too. All these in addition to the Kaspersky CEO, Eugene Kaspersky’s tweet earlier have triggered Germany to issue an advisory today.
Yet, Kaspersky defended its stance that Germany BSI’s warning against using their products is more of a political decision rather than a technical assessment of their products. Here’s a full reply was given by Kaspersky to BleepingComputer on this issue:
We believe this decision is not based on a technical assessment of Kaspersky products – that we continuously advocated for with the BSI and across Europe – but instead is being made on political grounds. We will continue to assure our partners and customers in the quality and integrity of our products, and we will be working with the BSI for clarification on its decision and for the means to address its and other regulators’ concerns.
At Kaspersky, we believe that transparency and the continued implementation of concrete measures to demonstrate our enduring commitment to integrity and trustworthiness to our customers is paramount. Kaspersky is a private global cybersecurity company and, as a private company, does not have any ties to the Russian or any other government.
We believe that peaceful dialogue is the only possible instrument for resolving conflicts. War isn’t good for anyone.
Our data processing infrastructure was relocated to Switzerland in 2018: since then, malicious and suspicious files voluntarily shared by users of Kaspersky products in Germany are processed in two data centers in Zurich that provide world-class facilities, in compliance with industry standards, to ensure the highest levels of security. Beyond our cyberthreat-related data processing facilities in Switzerland, statistics provided by users to Kaspersky can be processed on the Kaspersky Security Network’s services located in various countries around the world, including Canada and Germany. The security and integrity of our data services and engineering practices have been confirmed by independent third-party assessments: through the SOC 2 Audit conducted by a ‘Big Four’ auditor, and through the ISO 27001 certification and recent re-certification by TÜV Austria.
Kaspersky has set the industry benchmark for digital trust and transparency. Our customers can run a free technical and comprehensive review of our solutions, allowing them to:
- Review our secure software development documentation including threat analysis, secure review, and application security testing processes
- Review the source code of our leading solutions including Kaspersky Internet Security (KIS), our flagship consumer product; Kaspersky Endpoint Security (KES), our flagship enterprise product; and Kaspersky Security Center (KSC), a control console for our enterprise products
- Review all versions of our builds and AV-database updates, as well as the types of information which Kaspersky products send to our cloud-based Kaspersky Security Network (KSN)
- Rebuild the source code to make sure it corresponds to publicly available modules
- Review the results of an external audit of the company’s engineering practices conducted by one of the ‘Big Four’ accounting firms;
- Review the Software Bill of Materials (SBOM) for Kaspersky Internet Security (KIS), Kaspersky Endpoint Security (KES), and Kaspersky Security Center (KSC)
