DHS can't enforce Kaspersky ban on private sector, but remains vigilant

Dive Brief:

Criticism followed the Department of Homeland Security's (DHS) decision to ban all Kaspersky Lab products from its technical infrastructure without providing substantial evidence for the ban besides suspicions of Kremlin-based ties. At a House Homeland Security Committee hearing, DHS cybersecurity official Christopher Kerbs said the bulk of evidence was based on "open-source information," reports The Hill.
The DHS is still collecting data from potentially impacted organizations, but Kaspersky Labs has not yet provided any material itself, said Jeannette Manfra, DHS' assistant secretary of cybersecurity and communications, to reporters at the launch of National Cybersecurity Awareness month in D.C.
When asked if the private sector should also comply with the DHS' ban, Manfra said "we can direct federal agencies based of our understanding of risk, and every company and other entities has to make their own risk management decision." The agency remains transparent in aiding organizations with any decisions.

Dive Insight:

Accusations of Kremlin ties continue to mount for Kaspersky Labs, a renowned Moscow-based antivirus software company. The DHS announced mid-September that all federal agencies had 90 days to remove the company's software from databases.

The software security company is accused of creating products that can infiltrate American computers, ultimately granting access for Russian intelligence. It is also said the antivirus products could serve as malicious spyware or malware attacks.Kaspersky denied the claims, saying it will comply with the U.S. federal government to prove the "allegations are unfounded."

The company's products are still widely used by U.S. consumers and the enterprise, but the DHS' decision pushed companies like Best Buy and Office Depot to remove Kaspersky products from their shelves. Both store chains are offering customers free removals and an alternative security software.

It is still unclear what Kaspersky's major partners, including Microsoft, Intel and IBM, will do if more definitive evidence of cybercrimes emerges.