Australia Bans Kaspersky Lab Products On Government Systems To Mitigate Cybersecurity Risks

The Australian Department of Home Affairs has mandated that government entities must prevent the installation of products and web services on government systems and devices from Kaspersky Lab. Additionally, any existing instances must be removed. The directive, issued under the Protective Security Policy Framework (PSPF) by the Secretary of the Department of Home Affairs, aims to manage and mitigate security risks to the Commonwealth.

“After considering threat and risk analysis, I have determined that the use of Kaspersky Lab Inc. products and web services by Australian Government entities poses an unacceptable security risk to Australian Government, networks, and data, arising from threats of foreign interference, espionage and sabotage,” Stephanie Foster, secretary at the Department of Home Affairs, wrote in a direction last week. “I have also considered the important need for a strong policy signal to critical infrastructure and other Australian governments regarding the unacceptable security risk associated with the use of Kaspersky Lab, Inc. products and web services.”

She added that entities must manage the risks arising from Kaspersky Lab’s extensive collection of user data and exposure of that data to extrajudicial directions from a foreign government that conflicts with Australian law.

Foster detailed that by Apr. 1, this year, all non-corporate Commonwealth entities must identify and remove all existing instances of Kaspersky Lab products and web services on Australian government systems and devices. They must also prevent the installation of Kaspersky Lab products and web services on Australian government systems and devices; and report completion of these requirements to the Department of Home Affairs’ Commonwealth Security Policy Branch.

Furthermore, the Accountable Authority may seek an exemption for a legitimate business reason, limited to national security and regulatory functions, for the use of Kaspersky products and web services on Australian government systems and devices and must ensure that appropriate mitigations are in place.

About three years ago, the U.S. Federal Communications Commission (FCC) banned communications equipment and services from Kaspersky, China Telecom, and China Mobile, as they threatened national security. These vendors were added by the FCC’s Public Safety and Homeland Security Bureau to its list of communications equipment and services that pose a threat to national security. The ban is consistent with requirements in the Secure and Trusted Communications Networks Act of 2019.

The post Australia bans Kaspersky Lab products on government systems to mitigate cybersecurity risks appeared first on Industrial Cyber.