KasperskySecurity for Virtualization Light Agent

Deep integration with platform APIs leverages the deployment, configuration, management and reporting mechanisms of the VDI platforms to ensure high levels of security and control over the user environment.

A wide range of Windows and Linux guest operating systems are supported in VMWare Horizon, Citrix Virtual Apps and Desktops as well as HyperV VDI environments.

To deal with the risks from exploitation of unpatched vulnerabilities, Kaspersky Hybrid Cloud Security incudes a range of Exploit Prevention technologies.

The Exploit Prevention mechanism specifically monitors the most frequently targeted applications – including Adobe Reader, Internet Explorer, Microsoft Office, Java and many more – delivering an extra layer of security monitoring and protection against unknown threats.

Behavior Detection does not rely on signatures of known threats; instead, it leverages techniques including Machine Learning to identify and extract suspicious behavior patterns during execution. This means that even never-before seen threats can be reliably blocked based simply on the presence of malicious actions.

Configurable Application Control tools let you to specify which applications are allowed to run on which VMs. This reduces exposure to risk and wasted resources due to running unnecessary software.

There’s a choice of a Default Allow policy, that allows the execution of all applications except the specifically denylisted ones, or a Default Deny policy, that blocks all programs except those on the allowlist.

Kaspersky’s Application Control consists of:

• Application Startup Control –allows or disallows each application startup on the protected system
• Application Privilege Control – registers applications and regulates their activity according to the rules set. The rules define whether an application is allowed to access operating system resources and a user’s personal data.

Kaspersky Security for Virtualization Light Agent fully supports linked and full cloning. Thanks to the pre-installed lightweight agent, provisioning a new VM simply involves cloning a template. Once cloning is complete, the new machine is automatically protected by the SVM. This simplifies VDI management, eliminating the need to update security products on the VDI image.

System Watcher technology built into Kaspersky Security for Virtualization Light Agent monitors the behavior of applications running inside each virtual desktop. If suspicious behavior is detected - such as cryptor or locker activity - it’s immediately blocked and any malicious changes are automatically rolled back, keeping your critical data secure.

Web Control helps manage Internet use, blocking VM access to specific websites or automatically updated categories such as social networks, music, videos and personal web email. Different control policies can be set for different job roles, blocking access around the clock or during specific times during the day.

Because users can connect to their VDI machine from anywhere, on any device, it’s important to ensure that VMs aren’t exposed to threats from unsecured USB devices. With Device Control, administrators can specify exactly which removable devices can be accessed in each individual VM. It’s easy to apply control policies to a range of devices, including removable drives, printers and non-corporate network connections. For VMware installations, this technology complements and enhances existing Horizon USB Redirection capabilities.

AMSI Protection allows Microsoft Office applications and other third-party programs to send requests for scanning objects for viruses and other threats using Windows Antimalware Scan Interface (AMSI).

The Kaspersky Security for Virtualization Light Agent user interface can be disabled (by unloading it) on any or all VMs for additional performance optimization.