Ransomware & Security for Virtualization Zack Ehrhardt Kaspersky Lab Zachary.Ehrhardt@Kaspersky.com 781-503-2680

RANSOMWARE BY THE NUMBERS 3x Ransomware attacks on businesses increased threefold Attacks on small businesses increased eightfold* Frequency of ransomware attacks on businesses Cost of a single cryptomalware attack for SMBs Enterprises in NA who suffered four or more data breaches in the past year** The cost of a single cybersecurity incident for large businesses 8x Every 40 seconds $99,000 44% $861,000

HOW DO WE GET INFECTED WITH RANSOMWARE? Source: Osterman Research, Inc.

NO MORE RANSOM Founding partners: European Cybercrime Centre, Politie, Intel Security and Kaspersky Lab Additional partners: Over 30 organizations in security, cloud services and law enforcement Goal: Help ransomware victims retrieve their encrypted data without paying the criminals Project aim: Prevent ransomware by educating users about prevention https://www.nomoreransom.org

Kaspersky Security for Virtualization

Dilbert’s Take on Virtualization

Basic Theory for Security Chance of getting infected Investment in Security The chance of getting infected drops exponentially by increasing the investment in security

Kaspersky Security Center IT security in a single-pane-of-glass view All protected machines – Virtual / Physical / Mobile Protection status at a glance with actionable intelligence

Excessive resource consumption Update storms Instant-On gaps Agent-based Security in a Virtual Environment Redundant Excessive resource consumption Update storms Instant-On gaps Lower VM densities Each guest protects itself - Antimalware stored locally on each VM. Requires a separate process to scan each VM

Is there a better way to protect virtualized environments from malware?

Aligning the Security approach to the environment Traditional Agent-Based Works on any hypervisor Where VM density is not critical Windows, Linux or Mac guest VMs Offers anti-cryptor feature for file servers Agentless Security VMware only Allows high VM density Windows guest VMs only Small IT resources to manage security Typical installation would be server virtualization with no/or controlled internet connectivity (limited browsing) Light Agent Security VMware, Hyper-V, Citrix, or KVM Allows high VM density Windows and Linux guest VMs Advanced security requirements: IM, Web and Mail AV Application, Web and Device controls Automatic Exploit Protection Typical usage would be VDI and servers with critical Internet facing roles

Enterprise class failover Light Agent Security Keeps consolidation ratio high Still easy to deploy and manage No problems of Agent-based security VMWare, Citrix, Microsoft, KVM Advanced protection Enterprise class failover LIGHT AGENT Advanced antimalware Advanced protection from network threats Controls SECURITY VIRTUAL APPLIANCE Anti-malware databases Centralized file scanning KSV | Security Options

SECURITY VIRTUAL APPLIANCE Agentless Security Eliminate redundant security Reduce boot latency Keeps consolidation ratio high Extremely easy to deploy and manage Agent-based security issues eliminated, but.. File scanning security Only VMware Excessive resource consumption Update storms Instant-On gaps Lower VM densities Every VM get basic protection automatically w/o installation of any additional software SECURITY VIRTUAL APPLIANCE Anti-malware databases Centralized file scanning

2 Simple Takeaways… Be proactive when protecting against ransomware Choose the right security option for your virtual environment

Thank you!