Kaspersky Endpoint Security for Business

Malware remains a widespread, expensive threat, with estimated global cybercrime costs tied to malware rising from $2 trillion in 2019 to $6 trillion by 2021. Modern malware spans viruses, worms, rootkits, botnets, file-less malware, ransomware, and crypto-miners, typically exploiting operating system or application vulnerabilities. Viruses have become polymorphic to evade detection and often rely on user interaction, while worms propagate across unsecured networks using unpatched applications and exposed ports. Rootkits operate at low levels like device drivers, enabling full system control, and botnets aggregate compromised devices to amplify attacks such as DDoS, credential stuffing, and account takeovers.

Ransomware remains a top concern because it quickly reveals itself only after compromise, leaving victims to either pay (discouraged and unreliable) or restore from backups—often slow or impossible without tested backup processes. Most ransomware arrives via weaponized Office documents in phishing campaigns; disabling macros helps but is not universally feasible. Crypto-jacking persists by covertly mining cryptocurrency on victims’ devices, increasing power use and draining mobile batteries, and early anti-malware tools sometimes failed to flag miners because they could be built from legitimate code.

Kaspersky Endpoint Security for Business (KESB) provides multi-platform endpoint protection managed through Kaspersky Security Center (on-premises, hybrid, or IaaS). It combines kernel-level self-defense, cloud reputation via Kaspersky Security Network (or a Private Security Network for isolated environments), and layered machine learning for pre-execution and post-execution detection, including similarity hashing and behavioral analysis. KESB adds exploit prevention, file-less malware defenses, ransomware rollback capabilities, URL filtering, firewalling, application whitelisting, and adaptive anomaly control, plus SIEM and RMM/PSA integrations. Key challenges include lack of MFA and SAML federation for the SaaS console and a noted North America sales impact in 2018 from political factors.

• Total malware-related cybercrime costs were estimated at $2 trillion globally in 2019 and projected to reach $6 trillion by 2021.
• Viruses are commonly polymorphic and change structure to avoid detection on each iteration.
• Worms spread across unsecured networks by leveraging unpatched applications and unprotected ports.
• Rootkits are typically implemented at a low level like device drivers and can provide complete control of affected machines.
• Botnets are collections of controlled devices used to magnify attacks such as DDoS, credential stuffing, and account takeovers.
• Most ransomware attacks arrive through weaponized Office documents delivered by phishing campaigns.
• Crypto-jacking increases power consumption and can deplete mobile device batteries.
• Kaspersky reported observing and blocking 70 million uses of crypto-miners in 2017.
• Kaspersky Security Center can forward events to SIEMs including ArcSight, Splunk, and QRadar, and to any SIEM supporting syslog.
• MFA is not available for the SaaS-hosted Kaspersky management console, and SAML federation for administrative users is not supported.

• “Viruses are generally polymorphic, meaning they alter their structure to try to avoid detection upon every iteration.”
• “Rootkits allow bad actors complete control of affected machines.”
• “File-less malware is malicious code which spreads by process or memory injection.”
• “Once on a target device, file-less malware uses native tools like PowerShell to assemble and execute the malicious payload.”
• “Paying the ransom only emboldens the perpetrators and perpetuates the ransomware problem.”
• “Thus, preventing ransomware infections is preferred.”
• “However, no anti-malware product is 100% effective at prevention.”
• “Windows platforms are still the most vulnerable, though there are increasing amounts of malware for Android.”
• “Apple’s iOS and Mac devices are not immune from malware.”
• “Adaptive Anomaly Control runs first in a passive, learning mode, collecting statistics on control rules triggered over a set time period so that it builds a baseline of normal activity for the particular user or a group.”