Kaspersky Enterprise Cybersecurity

Kaspersky ManagedDetection and Responsewww.kaspersky.com#truecybersecurityKaspersky Managed Detection
and Response
ProblemStatement

Kaspersky Managed Protection
and Incident Response

As corporate processes undergo extensive, across-theboard automation, businesses are becoming increasinglydependent on information technologies. This, in turn,means the risks associated with disruption to core businessprocesses are steadily shifting to the IT field. The developers
of automation tools are aware of this and, in an attempt
to address possible risks, are increasingly investing inIT security – a key characteristic of an IT system alongwith reliability, flexibility and cost. The last coupleof decades have seen a dramatic improvement in thesecurity of software products; virtually all global software
manufacturers now publish documents dedicatedto safety configurations and secure use of their products,
while the information security market has been flooded
with offers to ensure protection in one form or another.

Kaspersky Lab has been researching and preventing
computer attacks for over 20 years. We can say witha degree of confidence that the list of threat detection andprevention technologies that we’ve developed over
the years, including the latest research on big data andmachine learning, means Kaspersky Lab’s security
products can stop any attack that can be detected andneutralized in automated mode.

On the flipside, the more a company’s business isdependent on IT, the more attractive the idea of hacking
its information systems. The aforementioned increasein software security levels has resulted in more resources
being required to successfully carry out hacking attacks.
The increased minimum costs of a successful attack,in combination with cybercriminals having to establish
a long-standing presence within the target infrastructure
to overcome the multiple layers of defense and ensure
a maximum return on their investments, have led to theemergence of targeted attacks. Such attacks are carefullyplanned and implemented; along with automatic tools, theyrequire the direct and deep involvement of professional
attackers whose work is not dissimilar to that of penetration
testing teams. Counteracting these professional attackers takes
professionals that are no less qualified and equipped with thelatest tools for detecting and preventing computer attacks.
Professional publications often advance the theory thatan organization’s security goals can be considered achieved
when the cost of compromise exceeds the value of theprotected information assets. However, this premise has had
to be substantially reevaluated in light of recent publications
on CIA and NSA cyber weapons. Practice has shown that thedevelopers of cyber weapons don’t care that much aboutkeeping their creations secret, meaning there is a goodchance those creations will end up in the hands of potential
threat actors whose research resources are far more modest.
Given that the resources of intelligence services are virtuallyunlimited, it becomes clear that the possibility of using theircreations dramatically cuts the cost of hacking. The only way
to counter such threat actors is to adopt a systemic approachto protection. This implies prompt detection if a threat isimpossible to prevent, and if detection is impossible, thenhaving an effective response and restoration capabilities
to mitigate the damage from attacks. This is especially
important given that these attacks can be activated at various
stages, via various vectors and in various environments,using a wide range of tactics, procedures and technologies.

Targeted attacks, however, take the protection tools
available to their victims into consideration and aredeveloped accordingly, bypassing automatic detection andprevention systems. These kinds of attacks are often carriedout without any software being used, and the attackers’
actions are barely distinguishable from those that
IT or information security officers would perform.
The following are just some of the techniques used inmodernday attacks:• the use of tools to hamper digital forensics, e.g.
by securely deleting artefacts on the hard drive
or by implementing attacks solely within a computer’smemory;• the use of legitimate tools that IT and information
security departments routinely use;
• multi-stage attacks, when traces of preceding stages are
securely deleted;• interactive work by a professional team (similar to thatused during penetration testing).
This sort of attack can only be detected after the target
asset has been compromised, as only then can suspicious
behavior indicative of malicious activity be detected.
An approach called cyber threat hunting is used to detectattacks after the initial breach has taken place; a key
element is the involvement of a professional analyst at thefinal stage of decision making. A human presence within theevent analysis chain helps compensate for the weaknessesof automatic threat detection logic. Moreover, when
pentest-like attacks involve a human on the attacking side,that human undoubtedly has an advantage when it comesto bypassing automatic technologies, so the presenceof a human analyst is the only way to withstand suchattacks. Neither automated threat detection and prevention
tools nor cyber threat hunting alone is a silver bullet for theentire modern spectrum of threats. However, a combinationof traditional detection and prevention tools active before
a compromise occurs, plus a post-compromise iterative
process of searching for new threats missed by automatedtools can be effective.

Kaspersky Managed Protection

Incident Reponse

Compromise

Products, alerts

Cyber Threat hunting

Pre Compromise

Kaspersky Managed Protection (KMP) implements all thelatest approaches to cyber threat hunting, improving theoverall quality of threat detection by Kaspersky Lab
products by supplementing multiple automated detection
technologies with the skills of professional analysts.
KMP’s key advantage is that it detects attacks that
automated detection and prevention tools have missed,including:• detection of new malware that products failed to detectin automated mode; • detection of persistent attacks
whose activities are below the detection thresholds
of automated logic;• detection of attacks launched without the useof malware;• detection of fileless malware whose activities areexecuted exclusively in RAM memory;• detection of pentest-like attacks carried out
by professional attackers.

Incident responce

Time

Post Compromise

As part of the Incident Response service, each security
incident undergoes in-depth analysis, which resultsin the creation of new, more effective attack handlingprocedures, and measures are taken to prevent similar
attacks in the future.
The KMP and Incident Response services complement
each other nicely, because a more effective response thanthat provided by automated detection via the protection
service can be determined through incident investigation
procedures. At the same time, any investigation requires
facts that can be established by analyzing events within
the framework of Kaspersky Managed Protection.
Despite the close connection and benefits of integration,
Kaspersky Managed Protection and Incident Response
are implemented as two separate services within theKaspersky Lab services portfolio – this provides the clientwith extra flexibility when choosing which better suits
their needs.

As well as detection, KMP also offers the following
benefits:• the ability to reproduce the sequence of attack stages
if the attackers use techniques to hinder an investigation(secure deletion tools, multiple stages, etc.);• 100% relevance for customers, because attacks aredetected as part of an analysis of their IT infrastructure;• if technically feasible, real-time protection can beprovided with Kaspersky Lab’s prevention products(Kaspersky Endpoint Security, Kaspersky Security for
Mail Gateway, etc.), with subsequent supervisionof treatment to ensure its effectiveness.
However, not all attacks can be stopped solely by adding
neutralization components to an automated protection
tool: if an attacker notices that they have been detected,
they will change their tools and tactics and fall off theradar until detected again by an analyst within theframework of cyber threat hunting. Repeating this cycle
is obviously not an effective way to solve the problem,so the additional Incident Response service comes intoplay here – it includes research on new malware samples
and digital forensics.

Unique Experience of
Researching Targeted
Attacks
Kaspersky Lab has a proven track record of effective
targeted attack research, with the company’s experts
detecting the most advanced targeted attacks on a global
scale, including Duqu, Project Sauron, Lambert, Equationand many more, as well as providing protection tools forthem. For a chronology of the most notorious attacks, see
https://apt.securelist.com/#!/threats/.

www.kaspersky.com
ExpertAnalysis#truecybersecurity

HuMachine™

© 2018 AO Kaspersky Lab.
All rights reserved. Registered trademarks and service marks are the propertyof their respective owners.

MachineLearning

Big Data /Threat Intelligence