Transparency at Kaspersky

[harlan4096]

How our Global Transparency Initiative is evolving.

In 2017, we launched our Global Transparency Initiative (GTI). Under this project, we moved part of our data infrastructure to Switzerland and opened Transparency Centers where our partners and customers can review the source code of our products. We also had our data services and engineering practices evaluated by third-party independent accredited organizations. In addition, we now regularly disclose information regarding requests from government agencies for data and technical expertise which Kaspersky receives in the context of cybercrime investigations. Today, we will talk about new steps in this initiative.

What has been done as part of the Global Transparency Initiative

In the five years since we launched the program, we have opened four Transparency Centers where our customers and partners can review our products’ source code, software updates to make sure there are no hidden features or undocumented capabilities in our solutions. In addition, we also provide our engineering and data management practices for external examination. Kaspersky Transparency Centers operate in Europe, Latin America and Asia. For those unable to visit our Centers in person we offer remote visits.

As a technology and cybersecurity company, we process data which our products use to increase the effectiveness of the cyber-protection provided to users. This data includes information about cyberthreats — for example suspicious and malicious files which our products send, if users agree, for automated cloud-based malware analysis. The data helps us identify new and unknown threats, continually improve our solutions, and offer users better ways to protect themselves.

Since November 2018, such cyberthreat-related data of our users in Europe has been stored and processed in our data centers in Switzerland. A short while later, we also relocated to Switzerland processing and storage of such data for users in North America, Latin America, the Middle East, and a number of countries in the Asia-Pacific region.

We also received ISO 27001 compliance certification from the TÜV AUSTRIA independent certification body. It confirmed that our company has an effective information security management system in place. Our users can be confident that the data processed by Kaspersky is under the highest level of protection.

Besides, we launched Cyber Capacity Building Program training for companies, government organizations, and academia to help them develop the skills needed to protect their IT systems. More recently, we extended opportunities and launched a digital version of training, which can now be accessed by both organizations and individual users.

New steps to transparency

Kaspersky has done a lot of work on the road to greater transparency, and does not plan to stop there. We have recently taken new steps as part of the Global Transparency Initiative (GTI).

Data center expansion in Zurich

Since the beginning of 2022, we have significantly increased the capacity of our data centers in Zurich, where we now process malicious and suspicious files from users in Latin America and the Middle East. We have also relocated the processing and storage of such cyberthreat-related data for North American countries that weren’t previously included: Mexico, Panama, Jamaica, and other island nations.

Switzerland was chosen for a reason: the country has one of the stringent data protection regulations. Our two data centers in Zurich also operate with world-class equipment that meets the highest industry standards.

ISO 27001 recertification

Kaspersky data systems were recertified by TÜV AUSTRIA in accordance with the requirements of ISO 27001. And it’s not just certification renewal; this time the scope of the audit was significantly expanded. The certification now covers both data systems for processing cyberthreat-related data (Kaspersky Distributed File System, KLDFS) and statistics (KSNBuffer database).

TÜV AUSTRIA is an independent certification body. We are proud that Kaspersky’s approach to data security has once again been recognized.

Working with requests from government and law enforcement agencies

Alright, you say, user data is secure, but what about information requests from law enforcement agencies? In fact, Kaspersky regularly shares about its approach toward working with such requests and since last year, the company has been issuing reports on requests from law enforcement and government agencies, In addition, we’ve just recently published a report for the second half of 2021. Here are some key figures:

• Our experts received 109 requests from government and law enforcement agencies from 12 countries.
  
• 92 requests referred to technical expertise, and 17 contained a request for access to user data.
  
• All 17 requests to hand over user data were rejected. Some of them did not meet legal requirements, while others asked for data that the company simply did not have.
  

Users too ask us where and how their personal data is stored. Some people request to download or delete it. In 2021, we handled 2,252 requests of this kind.

New level of education program

Kaspersky is always ready to share its experience with the global community. We have expanded our Cyber Capacity Building Program by launching a similar online course. Now even more partners and customers can take part in the program. The training will help organizations and individuals assess the security of the software they use and reduce the risk and potential consequences of cyberattacks.

What’s next

The trust of users, customers, and partners, is our top priority. We continue to refine our security practices and develop the Global Transparency Initiative, and hope that it will one day become the international standard for cybersecurity industry.

As for the quality of protection that our security solutions provide, we have good news here as well. We’ve recently summarized the results of dozens of tests and reviews by leading independent laboratories that included our products in 2021. You can check out the results here.
...

Continue Reading

[dinosaur07]

This is a very solid and professional company. Thanks for the info @harlan4096