Posts
Russia's Kaspersky Labs to Develop a Secure O/S for Critical Infrastructure and Military Use
A Russian IT news service has reported that Kaspersky Labs is developing its own secure operating system for use in industrial control systems. One of Eugene Kaspersky's competitors, Renat Yusupov of Kraftway, predicts that Kaspersky is "most likely developing a process control operating system where security is vital. It will probably be used in production, aviation, transport, energy, and may be used for military purposes."
While Kaspersky Labs hasn't made an official announcement, it has advertised for a requirements analyst and a senior security system designer for SCADA automated control systems. The ad which was listed with a HeadHunter website also said that Kaspersky is developing a new secure operating system.
Kaspersky has been in the forefront of investigating the Stuxnet, DuQu, and Flame attacks against Iran so the announcement that it's developing a secure O/S for the same types of systems that Stuxnet was designed to attack makes a lot of sense. Further, the quality of their security research plus the fact that Russia produces some of the best software engineers in the world suggests to me that this product could be in high demand - especially by its Rosatom customers. However, Kaspersky's close relationship with Russia's security services should also be considered by its potential customers. Under Russian law, the FSB could ask Kaspersky to include a backdoor in its secure O/S and the company would be required to comply. In fact, I can't imagine the FSB missing out on such an opportunity for intelligence collection against potential customers among the Commonwealth of Independent States, India, China, South Africa and others.
While Kaspersky Labs hasn't made an official announcement, it has advertised for a requirements analyst and a senior security system designer for SCADA automated control systems. The ad which was listed with a HeadHunter website also said that Kaspersky is developing a new secure operating system.
Kaspersky has been in the forefront of investigating the Stuxnet, DuQu, and Flame attacks against Iran so the announcement that it's developing a secure O/S for the same types of systems that Stuxnet was designed to attack makes a lot of sense. Further, the quality of their security research plus the fact that Russia produces some of the best software engineers in the world suggests to me that this product could be in high demand - especially by its Rosatom customers. However, Kaspersky's close relationship with Russia's security services should also be considered by its potential customers. Under Russian law, the FSB could ask Kaspersky to include a backdoor in its secure O/S and the company would be required to comply. In fact, I can't imagine the FSB missing out on such an opportunity for intelligence collection against potential customers among the Commonwealth of Independent States, India, China, South Africa and others.
You mean that the FSB could also control your toaster?
ReplyDeleteIs the trust relationship so different from the US / Microsoft relationship?
ReplyDeleteWasn't Flame using Microsoft certficates to infect systems through for example WSUS?
Isn't there a relationship between Flame and Stuxnet?
Wasn't the Bush / Obama administration involved in Stuxnet?
Sihoko, none of your points really change the reality of Kaspersky's relationship with the Russian gov't, which is what I was addressing here. U.S. activities are a completely different subject that's unrelated to Kaspersky's move into ICS software development and possible security risks for its customers.
ReplyDeleteAgreed. As long as that law mandating that they have to put a 'government backdoor' in software is in place, I would be very hesitant to use any software made in Russia.
DeleteIf Russia wants to compete on the global landscape, they are going to have to get rid of laws like that.
This comment has been removed by the author.
ReplyDeleteAll the more reason to deploy secure open source OS's instead. This greatly reduces the risk of government-sponsored back doors. As a British citizen, the notion of foreign "security services" (and heaven knows who else) being allowed free reign over my country's critical systems is intensely undesirable.
ReplyDeleteNo such thing as a 'secure OS' when it comes down to it. All OS's have VULN's that someone can use to get into them.
ReplyDeleteTo Mr. Goose, it's time to wake up: open source does NOT mean that someone cannot put 'bad shit' in a program or OS.
I meant secure in the sense that security is an intrinsic part of its design. But if it makes you happy, then let's say "relatively secure".
ReplyDeletePoint is, source that is open greatly reduces the likelihood of back doors because the code can be scrutinised, whereas closed code cannot.
Finally, if you re-read my post, then you will find the sentence:- "This greatly reduces the risk of government-sponsored back doors." I *never* claimed it eliminated it entirely.
With respect, perhaps it is you that should wake up?