Kaspersky Expands its Network of Transparency Centers

Kaspersky has established three new Transparency Centers in Japan, Singapore, and the United States. The expanded facilities provide more opportunity for customers and partners to learn more about Kaspersky’s engineering and data processing procedures, as well as evaluate the company’s source code and other business sectors.

IT technologies now touch practically every part of our lives, and the amount of data entrusted to them grows significantly each year. This has made data processing the backbone of digitalized civilizations. Data processing volumes are expanding substantially as global data output continues to rise. Kaspersky launched the Global Transparency Initiative (GTI) to equip company stakeholders with knowledge and provide them the confidence to trust Kaspersky.

Opening a global network of Transparency Centers — trustworthy facilities where customers and partners can review the company’s code, software upgrades, threat detection rules, and other activities — was one of the GTI’s cornerstones. No other cybersecurity supplier has gone so far as this. Kaspersky is taking a huge step toward becoming entirely transparent in its protection technologies, infrastructure, and data processing methods by launching these Transparency Centers. Since the first center opened in Zurich, Switzerland, in 2018, Kaspersky has opened several more and now has code review centers in Madrid, Spain, Kuala Lumpur, Malaysia, and So Paulo, Brazil (Brazil).

The newly launched Transparency Centers will welcome the company’s enterprise partners and customers, including state agencies and regulators in charge of cybersecurity. Two additional facilities in APAC — in Tokyo and Singapore — ensure the company’s greater proximity to stakeholders in this region, while the center in Woburn, MA in the United States will serve as a new venue for the company’s North American Transparency Center, which was previously located in New Brunswick, Canada.

To make visits to Kaspersky’s Transparency Centers as rewarding as possible, the company provides a variety of read-only review options based on visitors’ skills and interests, ranging from a general overview of Kaspersky’s security and transparency practices to a comprehensive review of Kaspersky’s source code guided by the company’s experts.

Kaspersky offers source code reviews purely for consultation reasons and adheres to the strictest access policy, which means that a request for a source code review could be denied if security issues are raised. Kaspersky provides read-only access to its source code for review, which eliminates the chance of any alterations.

With the assistance of Kaspersky’s experts, visitors to the Transparency Centers can:
• review the company’s secure software development documentation, and source code of the company’s key product portfolio, including flagship consumer and enterprise products, as well as all the versions of our software updates and threat detection rules;
• rebuild the source code to ensure it corresponds to the publicly available modules. The compilation process – available at Transparency Centers – provides security assurance about the integrity of Kaspersky’s source code.
• check the Software Bill of Materials (SBOM) for Kaspersky products to enhance supply chain security;
• review the results of third-party security audits (such as the SOC 2 audit report and ISO 27001 assessment report) – both remotely and physically.

Since the first Transparency Center opened in Switzerland in 2018, the company has organized over 25 visits, with enterprise customers becoming the most regular visitors. Visitors have shown the most interest in information regarding Kaspersky’s data management methods, whereas source code reviews occur only on occasion, which could be explained by the existing requirement for cybersecurity capabilities across enterprises to appropriately handle product security evaluations. This, in particular, led to the launch of a dedicated Cyber Capacity Building Program (CCBP), by which Kaspersky experts aim to help a broader community worldwide learn practical tools and knowledge for such security assessments, and teach trainees about secure code review, code fuzzing and other.