Kaspersky Ban: Third-Party Risk Management Implications

In June 2024, the U.S. government banned the sale of and updates to software developed by cybersecurity company Kaspersky in the United States. The announcement followed a 2017 law that prohibited the use of Kaspersky software in government agencies. The U.S. is not the only country to make this decision. Governments in the United Kingdom, Germany, Italy, the Netherlands and other countries have also banned or are significantly limiting the use of Kaspersky software.

Although there is no direct evidence that illegal activity is occurring, the ban comes from concerns that the Russian government may have access to the Kaspersky network and their customer data. These governments are concerned that the access that Kaspersky uses to protect computer systems could be exploited to steal sensitive information or install malware. The Russian invasion of Ukraine furthered concerns of Russian cyberattacks leveraging access to the Kaspersky systems to conduct offensive operations against nations supporting Ukraine.

Third-party vendors and suppliers in these countries should have already cut ties with Kaspersky software in light of these bans. There’s no guarantee of this though, so it’s critical that organizations investigate their vendors and supply chains to identify instances of Kaspersky to avoid potential cyber, legal or reputational damage.

In light of this new ban, this post examines steps that organizations can take to discover and monitor instances of Kaspersky in their third-party vendor and supply chains and reduce risk.

Seven Steps to Mitigate the Risk of Banned Technology in Your Third-Party Vendor or Supply Chain

Consider these seven steps to discover, triage and monitor the use of Kaspersky in your vendor ecosystem. These steps also apply to any other banned technology, but we focus on Kaspersky in this instance.

1. Develop a centralized inventory of all third parties

A centralized inventory of all third-party vendors and suppliers adds governance and process to vendor management, and it reduces the likelihood of unmonitored vendor relationships introducing risk to your IT operations. Inventorying your vendors should be done in a centralized platform – not spreadsheets – that way multiple internal teams can participate in vendor management and the process can be automated for everyone’s benefit.

You can build a central vendor inventory by importing vendors to your third-party risk management platform via a spreadsheet template or through an API connection to an existing procurement or accounts payable solution. Teams throughout the enterprise should be able to populate key supplier details with a centralized and customizable intake form and associated workflow for approval. This capability should be available to everyone via email invitation, without requiring any training or solution expertise.

A central inventory of third-party vendors and suppliers has the added benefit of creating a single supplier profile that includes key attributes such as firmographic details, financial data, operational information, and other important insights into the company.

2. Build a map of third parties to determine technology concentration risk

Collect 4th-party technologies deployed in your vendor ecosystem during the inventorying process to help identify relationships between your organization and third parties based on certain technology usage. Doing this will help you visualize attack paths into your enterprise and take proactive mitigation steps. You can accomplish this through a targeted assessment or via passive scanning.

In the case of Kaspersky, having a map of vendors that utilize the now-banned tool would help you zero in on which vendors to assess for potential malware exposure. Focus on top-tier or business critical vendors first, as a disruption in their operations would potentially impact your organization more acutely.

3. Conduct an inherent risk assessment

After you centralize vendors and assess the presence of impacted technology, conduct inherent risk scoring assessments to help you determine how to assess your third parties on an ongoing basis according to the risks they pose. Attributes used to calculate an inherent risk score should at least include access to sensitive information or systems, regulatory and legal requirements, and geographic location.