As Kaspersky Deadline Approaches, Fears Loom That Contractors Aren’t Prepared

As the government barrels toward an Oct. 1 deadline for contractors to have Kaspersky Lab software completely scrubbed from their networks, technologists and acquisition experts worry contractors aren’t prepared.

In some cases, contractors may not even be aware that Kaspersky, a Russian anti-virus provider, is running on their networks because it came pre-installed with unrelated software, cyber watchers said.

That was frequently the case with the roughly 15 percent of federal agencies that were running Kaspersky.

In other cases, companies may have attempted to remove Kaspersky but missed some instances because removing any major software that stretches across an enterprise is far more complicated than simply pressing the uninstall button.

Finally, some contractors that don’t focus on technology, but nevertheless connect to government networks, may be unaware that the ban applies to them, said Eric Crusius, an attorney who focuses on government contracting issues at Holland and Knight.

“There’s so much going on in the government contracting community that certain things that don’t seem like priorities on the surface don’t get a lot of attention they should get,” said Crusius, who expects that Kaspersky will still be running on many contractor networks after the ban takes effect.  

Crusius added that there’s been “a surprising lack of urgent communication from the government” about the looming deadline considering the intense focus on the issue from Congress and cyber officials in government.

‘We’ve known about this for a long time’

The Kaspersky ban has been a long time coming.

The Homeland Security Department, which is the lead federal cybersecurity agency, first announced nearly a year ago that it would require civilian agencies to scrub Kaspersky from all their networks.

Department officials cited concerns the Russian anti-virus could be used as a Kremlin spying tool or that Kaspersky could be required to turn over customer information to Kremlin officials.

Congress followed up in December 2017 by banning Kaspersky software from all government networks, both military and civilian, in the National Defense Authorization Act, an annual defense policy bill.

The NDAA also banned Kaspersky from contractor networks and set the Oct. 1 compliance deadline.

Because the contractor ban comes from Congress rather than the Homeland Security Department, each agency is officially responsible for ensuring its contractors are complying with the order.

That’s a far more complicated process than the agency ban, for which Homeland Security vetted compliance centrally.

Agencies have all been Kaspersky free since at least May, according to Homeland Security officials. At that point, Kaspersky software remained on numerous contractor networks, many of which were unaware it was installed there, according to Homeland Security Secretary Kirstjen Nielsen.

Homeland Security’s top cyber official Jeanette Manfra expressed cautious optimism Thursday that contractors would meet the Oct. 1 deadline, saying she “thinks they’ll make it” and “[doesn’t] have any indication that we’ll have issues missing it, but can’t say definitively.”

Manfra added that Homeland Security has worked with some agencies to ensure contractors’ compliance and will continue to work with agencies after the ban takes effect if they have issues enforcing it.

“We’ve known about this for a long time,” Manfra said of the deadline.

Vicki Hildebrand, chief information officer at the Transportation Department, said Thursday that she was confident all Transportation Department contractors would be scrubbed of Kaspersky and that the department had provided training and vetting to ensure compliance.

“We’ve already really dealt with this,” Hildebrand said.

Uninstalling Isn't so simple

Among outside cyber watchers, though, there’s more concern.

A security team at BlueCat Networks was recently analyzing the Domain Name System records of a large company that has government contracts and that believed it was in compliance with the Kaspersky ban, BlueCat’s Chief Technology Officer Andrew Wertkin told Nextgov.   

The security team, which wasn’t hired to look for Kaspersky, discovered numerous instances of the Russian software that the company had missed, Wertkin said.

Wertkin and BlueCat Government Market Manager Ben Ball declined to name the company but said it had more than 3.2 million Internet Protocol addresses running on its network, providing a lot of places where a simple oversight could leave Kaspersky operating.

“What we saw at our customer proves there’s a lot more to do,” Wertkin said.

Part of the problem is that, as computer security packages that companies purchase have become more complex, it’s become increasingly difficult to uninstall their components, said Tony Cole, chief technology officer at Attivo Networks.

That means technologists will often have to manually uninstall leftover components of the software on specific computers, which can be a lengthy and labor-intensive process at a large organization, said Cole, who previously worked at Symantec and McAfee, both antivirus companies and Kaspersky competitors.

The problem is especially difficult with anti-virus, which is designed to protect itself from being uninstalled because a hacker’s first move is often to surreptitiously uninstall a system that would detect what’s happening and alert the user, Cole said.

Security packages are also so complex that it’s difficult to simply sub out one component for another, Cole said.

In other words, you can’t just replace everything Kaspersky was doing with Symantec or another competitor. You need to work out a more complex patchwork replacement, which also takes time and effort.

Even if a contractor is confident that Kaspersky is not running on its own networks, there are still questions about what contractors must do to ensure that the Russian anti-virus has been removed from its subcontractors’ networks and from its own complex supply chain, said Eric Crusius, the Holland and Knight government contracts attorney.

Those questions aren’t directly answered by the NDAA legislative language or in later guidance.

“There’s just not a recognition from contractors that Kaspersky would be more difficult to remove than they anticipated,” Crusius said. “It’s not a matter of just putting something in the recycle bin on your desktop.”