To this end the Cyber security firm launched the Global Transparency Initiative (GTI) as part of its ongoing commitment to assuring the integrity and trustworthiness of its products in service of its corporate mission, which is protecting customers from cyber threats, regardless of their origin or purpose.
With this phased Initiative, Kaspersky Lab will engage the broader information security community and other stakeholders in validating and verifying the trustworthiness of its products, internal processes, and business operations, as well as introducing additional accountability mechanisms by which the company can further demonstrate that it addresses any security issues promptly and thoroughly. As part of the Initiative, the company intends to provide the source code of its software, including software updates and threat-detection rules updates, for independent review and assessment.
A statement from the company states: “As society today depends ever more on information and communications technologies (ICT), cyber threats continue to proliferate and evolve. Because of the fast speed of both ICT deployment and the expansion of the threat landscape, Kaspersky Lab believes that increased cooperation to protect cyberspace is more crucial than ever.” It further notes that: “Trust is essential in cybersecurity, and therefore trust should be the foundation of any collaboration among those seeking to secure individuals, organizations and enterprises from cyber threats. However, Kaspersky Lab also recognizes that trust is not a given; it must be repeatedly earned through an ongoing commitment to transparency and accountability.”
The initial phase of Kaspersky Lab’s Global Transparency Initiative will include:
- The start of an independent review of the company’s source code by Q1 2018, with similar reviews of the company’s software updates and threat detection rules to follow.
- The commencement of an independent assessment of the company’s secure development lifecycle processes, and its software and supply chain risk mitigation strategies by Q1 2018;
- The development of additional controls to govern the company’s data processing practices in coordination with an independent party that can attest to the company’s compliance with said controls by Q1 2018;
The formation of three Transparency Centers globally, with plans to establish the first one in 2018, to address any security issues together with customers, trusted partners and government stakeholders. The centers will serve as facilities for trusted partners to access reviews on the company’s code, software updates, and threat detection rules, along with other activities.
There is increase of bug bounty awards up to $100,000 for the most severe vulnerabilities found under the company’s Coordinated Vulnerability Disclosure (CVD) program to further incentivize independent security researchers to supplement Kaspersky Lab’s vulnerability detection and mitigation efforts, by the end of 2017.
In addition to launching this initial phase of its Global Transparency Initiative, Kaspersky Lab looks forward to engaging with its stakeholders and the information security community to determine what the next phase of the initiative, which will commence in H2 2018, should include. The company has further thrown suggestions for further steps, and requests by third parties interested in collaborating with the company open.
Speaking of the need for this new initiative, Chairman and CEO of Kaspersky Lab, Eugene Kaspersky said: “Internet balkanisation benefits no one except cybercriminals. Reduced cooperation among countries helps the bad guys in their operations, and public-private partnerships don’t work like they should. The internet was created to unite people and share knowledge. Cybersecurity has no borders, but attempts to introduce national boundaries in cyberspace is counterproductive and must be stopped. We need to reestablish trust in relationships between companies, governments and citizens. That’s why we’re launching this Global Transparency Initiative: we want to show how we’re completely open and transparent. We’ve nothing to hide. And I believe that with these actions we’ll be able to overcome mistrust and support our commitment to protecting people in any country on our planet.”
Kaspersky Lab will share details of the Initiative’s progress and additional activities regularly. By collaborating with its various stakeholders, Kaspersky Lab hopes that its customers and partners will join it on this journey.