Federal agencies largely are complying with White House orders to remove Kaspersky Labs anti-virus software from government networks, according to a top Homeland Security Department official.<\/p>\n\n\n\n
After a binding operational directive was issued earlier this year to remove the Russian-backed software products from federal networks amid security worries, roughly 96 of 102 agencies have done so, DHS Assistant Secretary for Cybersecurity and Communications Jeanette Manfra told the House Science, Space and Technology Committee\u2019s oversight subcommittee on Nov. 14.<\/p>\n\n\n\n
She would not name the six non-compliant agencies, citing concerns that it would expose potential vulnerabilities and harm the relationship between DHS and those agencies. She said DHS is working with the six agencies to identify potential Kaspersky presence on their networks, and would work with the Office of Management and Budget if necessary to determine the appropriate response.<\/p>\n\n\n\n
\u201cThese are very small agencies, some with only six to 10 people, that do not currently have the resources and we are working with them to identify\u201d solutions, Manfra said.<\/p>\n\n\n\n
While lawmakers in the hearing pressed officials to determine who exactly was responsible for Kaspersky products ending up on federal systems, the officials said it wasn\u2019t so easy to pinpoint.<\/p>\n\n\n\n
\u201cThe government has been aware of increasing concerns [about] Kaspersky\u2026the agencies with that information did engage other agencies with procurement responsibilities,\u201d Manfra said, noting that supply chain risk management processes in the federal government badly need to be modernized. \u201cIn the end it is the responsibility of each of the agency heads to determine the way forward in risk management strategy, including in the supply chain.\u201d<\/p>\n\n\n\n
Agencies originally were given 30 days to identify whether Kaspersky software was on their networks and 90 days to get rid of it. Manfra said there is \u201cno conclusive evidence\u201d that any breaches have occurred as a result of the use of Kaspersky products, though 15 percent of agencies did find Kaspersky software on their systems.<\/p>\n\n\n\n
It is safe to say that none of the agencies was the Defense Department, where Kaspersky products were not approved for use after intelligence indicated potential risks, according to Essye Miller, DoD deputy CIO for cybersecurity and chief information security officer.<\/p>\n\n\n\n
The biggest concern, Miller and Manfra agreed, is that outside vendors bundle products and offerings together in providing contracted services \u2013 meaning federal agencies don\u2019t always know what\u2019s being used on their networks. The resulting supply chain security concerns underscore the serious need for risk management strategies, the officials said.<\/p>\n\n\n\n
\u201cWe have a responsibility to work with vendors to ensure there are risk management processes in place to ensure [what they\u2019re bringing into the supply chain is secure]\u2026and avoid risk introduced by industry partners,\u201d Miller said, adding that DoD is communicating with the defense industrial base to get across the security concerns. \u201cWe\u2019re working with our unclassified vendors through the [Defense Federal Acquisition Regulation supplement] to help them not only understand the risk, but understand the products they\u2019re using and their responsibility to protect government information and the government network.\u201d<\/p>\n\n\n\n
Most federal agencies are complying with orders to identify and remove Kaspersky Labs anti-virus software.<\/p>\n","protected":false},"author":7,"featured_media":39643,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":16,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"8":{"categories":["it-networks","it-cloud-report","newsletters","daily-brief","home"],"primary_category":"it-networks"}}},"categories":[10,106,29,16,32],"tags":[],"coauthors":[2772],"class_list":["post-13093","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber","category-daily-brief","category-home","category-it-networks","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"ORO7ECPWJRHE3GMIRHTIN43VVE","arc_canonical_url":"\/civilian\/dhs\/2017\/11\/14\/amid-federal-kaspersky-concerns-no-easy-scapegoat-but-some-action\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n