Administration server kes. Installing Kaspersky Security Center. System administration tools

Regardless of whether you manage ten or several thousand desktops as part of a centralized, distributed or mixed IT infrastructure, installation, configuration and administration of all Kaspersky Lab security solutions is carried out through a single management console.

Centralized management. Scalability. Flexibility

Kaspersky Security Center Enables effective mobile device management (MDM) across platforms, vulnerability monitoring and patch management, and control of the devices and applications allowed on your corporate network.

Kaspersky Security Center supports multi-level protection and management technologies that are activated through a single, convenient console. Kaspersky Security Center allows you to easily scale your protection system and add new tools and functions to it - both in small, rapidly growing companies and in large corporations with complex distributed IT infrastructure. Each subsequent level of the Kaspersky Security for Business solution opens up additional protection and management capabilities within a single platform - in accordance with your current needs.

Levels of Kaspersky Security for Business: consistent expansion of functionality

Centralized management allows you to increase the transparency of the corporate IT infrastructure, optimize costs and achieve maximum efficiency in managing the security system. Tightly integrated functions and tools within Kaspersky Security Center (KSC) provide effective management of all technologies implemented in a single Kaspersky Lab security platform.

• Deploying, configuring and managing endpoint protection from a single center allows you to ensure reliable and up-to-date protection for every endpoint and device in the corporate network.
• Mobile device security and management tools allow you to centrally manage the security of mobile devices across platforms through the same single console that you use to manage endpoint security. This greatly simplifies monitoring and control of the security of corporate IT infrastructure without the need for additional effort or technology.
• Vulnerability monitoring and patch management enable you to quickly detect vulnerabilities, prioritize them, and centralize patching. Administrators have complete information about detected vulnerabilities. Patches and updates can be installed automatically in the shortest possible time, which increases the level of security of the entire IT infrastructure.
• Centralized web, program and device control helps regulate and limit the use of unwanted or unsafe devices, programs and web resources.
• Centralized management of encryption technologies provides an additional layer of security, helping to combat the growing threat of data loss due to device theft or malicious attack.
• Advanced management capabilities include automated centralized administration of the protection system, including hardware and software, creating OS and application images, as well as remote installation Software and remote troubleshooting.
• Support for workstations, mobile devices and virtual machines makes it possible to manage the protection of the entire IT infrastructure through a single console, providing effective monitoring and complete control of the corporate network.

OPTIMAL DEFAULT SETTINGS
They are especially relevant for small companies that do not always have enough IT resources to perform additional administration tasks. Use the settings recommended by our experts, or choose those that are necessary for you.

SUPPORT FOR MULTI-PLATFORM ENVIRONMENTS
Manage the security of physical (Windows®, Linux®, Mac), mobile (Android™, iOS, Windows Phone) and virtual devices as part of the corporate IT infrastructure is carried out through a single console.

SCALABLE PROTECTION FOR COMPANIES OF ANY SIZE
Supports up to a million objects Active Directory®, as well as differentiation of administrator rights based on roles and settings profiles provide flexible work solutions in complex environments.

WIDE INTEGRATION OPPORTUNITIES
Integration with major SIEM systems for reporting and security. Integration with external systems NAC, including Cisco® NAC, Microsoft® NAP and SNMP server.

REMOTE OFFICE SUPPORT
Traffic optimization and flexible patch distribution. Local workstation can act as an update agent for an entire remote office, enabling remote deployment of updates and reducing traffic between offices.

DETAILED REPORTS
A wide range of predefined report templates, with the ability to customize and generate individual reports. Additional dynamic filtering and sorting of reports by any parameters.

WEB CONSOLE
Allows for effective remote management of the security of workplaces and mobile devices.

VIRTUALIZATION SUPPORT
Recognize virtual machines and balance the load during periods of intensive work, as well as prevent anti-virus storms that reduce performance - all through a single management console.


HOW TO PURCHASE

Kaspersky Security Center is included at all levels of the line, as well as a number of solutions for protecting individual network nodes.

For consultation and to receive a commercial offer, send a request to: [email protected]

We have reviewed functionality Kaspersky Endpoint Security 8 program, which provides a comprehensive multi-level protection system for computers running Windows operating systems. To centrally manage all deployed copies of Kaspersky Endpoint Security 8 on an organization's computers, the Kaspersky Security Center solution is used. In the second part of the review, we will look in detail at how administration occurs using the new, ninth Kaspersky versions Security Center and what main features it provides.

The main purpose of Kaspersky Security Center is to provide the administrator with tools for configuring all components of the security system and access to detailed information about the security level of the corporate network. Kaspersky Security Center is a single tool for centralized management of a large set of security tools in an organization, provided by Kaspersky Lab. The range of software products that can be managed using Kaspersky Security Center includes solutions for protecting workstations, servers and mobile devices:

• Kaspersky Endpoint Security 8 for Smartphone;
• Kaspersky Endpoint Security 8 for Windows;
• Kaspersky Endpoint Security 8 for Linux;
• Kaspersky Endpoint Security 8 for Mac;
• Kaspersky Anti-Virus 6.0 for Windows Workstation;
• Kaspersky Anti-Virus 6.0 Second Opinion Solution;
• Kaspersky Anti-Virus 6.0 for Windows Server s Enterprise Edition;
• Kaspersky Anti-Virus 8.0 for Windows Servers Enterprise Edition;
• Kaspersky Anti-Virus 8.0 for data storage systems;
• Kaspersky Anti-Virus 8.0 for Linux File Server;
• Kaspersky Anti-Virus 6.0 for Windows Servers;
• Kaspersky Anti-Virus 5.7 for Novell NetWare.

Figure 1. Logic of using Kaspersky Security Center to protect an organization’s network

Kaspersky Security Center can operate in two modes - normal, which is described in this review, and the mode necessary for the operation of service providers providing other organizations with protection of their networks in the form of a SaaS service. This mode requires a special license.

Kaspersky Security Center is not a separate program, but a set of software tools that includes:

• Administration server – a service responsible for security management. It is the main module of Kaspersky Security Center and stores all information about managed computers in a database (MS SQL Server or MySQL). In addition to the main administration server, you can organize hierarchical structure administration servers for working through them with remote parts local network or the local network of the serviced organization. This is especially true for companies whose structure is distributed. In this case local users They only access their server.
• administration console – a module implemented as a snap-in for the Microsoft Management Console and intended for managing the administration server;
• web console – a web application that has a purpose similar to the administration console. The difference is that the web console allows you to access the administration server through a browser using the web interface. However, compared to the same administration console, it has limited management capabilities;
• Kaspersky Security Center Administration Agent is a program designed for interaction between the administration server and client computers. It is installed on client systems and allows you to receive information about the current state of programs and events that occurred on client computers, send and receive control commands, and also ensures the functioning of the update agent.
• program control modules – modules that are installed on workplace administrator. Purpose – to gain access to software products Kaspersky Lab in the organization through the administration console.

Figure 2. Block diagram of interaction between Kaspersky Security Center components

The diagram shows that the administrator has the ability to work through the snap-in with several administration servers, which are, for example, company servers located in different offices. In addition, the administrator has the ability to access the administration server through an Internet browser from any computer without having to install any modules on it, which can be useful when it is necessary to monitor the security system. This access method is also used when deploying protection in an organization by an external service provider, whose administration server can be accessed from the protected network using the web console.

Figure 3. Web console usage diagram

;

Kaspersky Security Center allows you to configure and manage components and settings on client computers. For each user group or specific user, the administrator can set various settings the following components:

1. Protection components: file antivirus, mail antivirus, web antivirus, IM antivirus, firewall, protection against network attacks, network monitoring, system monitoring.
2. Control components: program launch control, program activity control, vulnerability scan, device control, web control.

Figure 4. Diagram of components managed by Kaspersky Security Center

The ninth version of Kaspersky Security Center is a development of the Kaspersky Administration Kit 8.0 tool. In comparison, a set of new functions has been added to Kaspersky Security Center. It has become possible to create virtual administration servers, control over the operation of the Application Control, Vulnerability Control, Web Control and Device Control components has been added; a web console has appeared for managing the administration server via a browser; client management functions have been added to virtual machines, it became possible to centrally detect and eliminate vulnerabilities on client computers. The functions of tools for managing installations of various components, obtaining additional information about controlled computers, creating reports and working with accounts have been significantly expanded.

System Requirements

To work with Kaspersky Security Center 9, your computer must meet the general system requirements listed in Table 1.

Table 1. Hardware requirements for working on different operating systems

Since Kaspersky Security Center 9 includes three components - the administration server, the administration console and the web administration console server, for each of them to work, the following requirements must be met.

Administration Server

• Microsoft Data Access Components (MDAC) 2.8 or higher or Microsoft Windows DAC 6.0.
• Microsoft Windows Installer 4.5 (for Windows Server 2008 / Windows Vista).

Database Management System

• Microsoft SQL Server Express 2005, 2008;
• Microsoft SQL Server 2005, 2008, 2008 R2;
• MySQL Enterprise.

Administration Console

• Microsoft Management Console 2.0 or later.
• Microsoft Internet Explorer 8.0.

Server web administration console

• Web server: Apache 2.2.
• Browser – Internet Explorer 7, Firefox 3.6 or Safari 4.

Functionality

The main functions of Kaspersky Security Center are to deploy protection on client machines, centralize the administration of these programs, and receive information about events on protected computers.

Deployment of protection

1. Remote installation and removal of endpoint protection software and administrative tools.
2. Deployment of third-party products or your own installation packages on protected computers.
3. Ability to install endpoint protection systems on infected computers.

Administration

1. Creation of virtual administration servers to ensure protection of physically remote segments of an organization’s local network or remote offices.
2. Formation of a hierarchy of administration groups for “flexible” configuration of rules for the work of various user groups.
3. Combining a set of rules and settings of various components into policies and flexible application of the created policies to regulate the activities of a specific user or group of users. The ability to use both standard policies and create new policies.
4. Implementation of centralized (if necessary, remote) management of programs to protect endpoints.
5. Centralized updating of databases and protection modules with endpoint protection programs.
6. Centralized work with files placed in quarantine or in backup storage, as well as with objects whose processing has been postponed.
7. Inventory of hardware devices and software on computers on the organization’s local network.
8. Centralized detection and elimination of vulnerabilities found in the operating system and various software.
9. Managing Kaspersky Endpoint Security 8 deployed in virtual environments ah (automatic detection of virtual machines, life cycle management of virtual machines, optimization of the load on the host server when performing resource-intensive tasks).

Monitoring

• Obtaining information about critical events on protected computers in real time.
• Receiving statistics and reports on all events on protected computers. It is possible to generate reports containing events in each protection component and administrator actions. Reports can be generated on a schedule or at the request of the administrator. If necessary, you can configure sending reports in a convenient format by email.
• Using the web console allows you to organize access to operational information about the protection status and reports from any computer on the network or remotely.

Also in Kaspersky Security Center there is now the ability to manage the protection of virtual workstations. When a new one appears on the network virtual machine, it is automatically found, connected to the administration console, and all the necessary protection components are installed on it. Kaspersky Security Center allows you to distinguish between virtual and physical machines and combine them into different groups for easy administration of the virtual infrastructure. Dynamic mode support for Virtual Desktop Infrastructure (VDI) is also implemented.

Preparation for use

To install Kaspersky Security Center, you need to run the program installation file, after which the installation wizard welcome window will appear.

Figure 5. Initial window of the Kaspersky Security Center installation wizard

Next you need to familiarize yourself with license agreement and accept its terms. After this, you need to select the installation type. The standard installation contains a minimum set of components and is recommended for networks containing up to 200 computers. Custom installation allows you to configure additional settings for Kaspersky Security Center and is recommended for networks containing more than 200 computers. Select a custom installation and click the “Next” button.

Figure 6. Selecting the Kaspersky Security Center installation type

The next step requires you to select the components to install.

Figure 7. Selecting Kaspersky Security Center components for installation

Figure 8. Selecting network size

In the next step, you need to select the account under which the administration server will run on the computer. You can choose one of two types of accounts - a system account (not available in Windows Vista and later Microsoft operating systems) or a user account.

Figure 9. Selecting the account under which Kaspersky Security Center will be launched

After this, you need to select the database type for the administration server - Microsoft SQL Server (Express Edition) or MySQL. When you select MS SQL Server, if this DBMS is not available, it will be installed. If you choose MySQL DBMS for operation, it must already be installed on the system.

Figure 10. Selecting a database server for Kaspersky Security Center

The next step is to configure the connection parameters to the server with the database. And then an account is configured to connect to the server.

Figure 11. Configuring connection parameters to a server with a database

After this you need to determine the location and name of the folder public access, in which they will be stored installation files and updates. You can create new folder or select an existing one.

Figure 12. Creating a public folder

Next, you must specify the port number for connecting to the administration server (“port 14000 is used by default”) and the SSL port number for a secure connection to the administration server using the SSL protocol (“port 13000 is used by default”).

Figure 13. Configuring connection parameters to the administration server

After this, you need to set the address of the administration server. The address can be a DNS name, NetBIOS name, or IP address.

Figure 14. Setting the address of the administration server

The next step is to select modules to manage programs. We need a module to manage Kaspersky Endpoint Security 8 for Windows, so we select it.

Figure 15. Selecting modules for installation

This completes the setup process and you can start installing the program. Next, you need to restart the operating system, after which the installation can be considered complete.

After installation you will need to make a series additional settings– specify the key or registration code, decide on the use of cloud technologies, configure the sending of notifications about the occurrence of events and proxy server settings. After this, you can start working with Kaspersky Security Center.

Working with the product

The administration server is managed through the administration console. It is a special snap-in that is integrated into the Microsoft Management Console (MMC).

Figure 16. Microsoft Management Console snap-in window

The advantage of using the snap-in is its standard interface, which is familiar to administrators working with Windows OS. In addition, you can add several different snap-ins to one management console. For example, " Windows Firewall", the defragmentation program "Diskeeper", the "Performance" snap-in and Kaspersky Security Center.

Figure 17. Example of creating a management console

The main window for working with Kaspersky Security Center consists of a menu, a toolbar, an overview panel (console tree) and a work area. After installing Kaspersky Security Center, we gain access to the administration server, through which we will manage instances of Kaspersky Endpoint Security 8 installed on computers on the local network.

With a distributed company structure, it is necessary to create a set of administration servers that will allow servicing each network segment separately, but, at the same time, centrally manage everything from one point. This will reduce traffic within the local network and simplify work with remote offices or local network segments. If you have several administration servers, you can delegate responsibility for security and authority to manage each virtual server individual administrators. You can add administration servers from the context menu of the “Kaspersky Security Center” node (“Create” – “Kaspersky Administration Server” – “Administration Server...”). The created hierarchy allows you to create rules for inheriting tasks and policies for different administration servers.

The hierarchy of tools for the administrator’s work is presented in Figure 18.

Figure 18. Hierarchy of tools for administrator work

The administration server can be used as a proxy server for Kaspersky Security Network (KSN), a special service - KSN Proxy - is responsible for this. Its use allows all computers under the control of the administration server to transmit and receive data to the “cloud” even if they do not have access to the Internet. Also, by caching requests, KSN Proxy allows you to reduce the load on Internet access.

Figure 19. Configuring KSN Proxy parameters

The logic for working with the program when deploying protection and administering it is constructed as follows. First, the administrator configures the administration server settings. After this, administration groups are created in accordance with the logic of the protected network. For example, accounting employees can be prohibited from using any removable media, and programmers can be configured with the most stringent web control parameters.

Computers are added to the created groups, and the Administration Agent and Kaspersky Endpoint Security 8 are installed on each computer. Security policies are then created and configured for each user group. The administrator can also create various tasks (virus scan, update, etc.) and set criteria for their execution (by timer, by event, etc.). After this, work with the program goes into the background - the administrator needs to periodically review reports, respond to threats, add new users for protection and perform other network maintenance work. Let's take a step-by-step look at how it works.

To manage protection settings on client computers, use the “Computer Management” group, which contains four panels: “Groups”, “Policies”, “Tasks” and “Computers”.

Figure 20. Computer Management group

Creating administration groups and setting them up

The “Groups” panel contains tools for managing groups of computers on the “Administration Server”. These administration groups allow you to organize a hierarchy of computers on the network in order to selectively apply various policies and tasks to them in the future. By default, only one, the root, group is available. Using the “Create Group” and “Create Subgroup” commands in the “Groups” panel, you can create the hierarchy of computer groups required in your organization.

Figure 21. Example of creating administration groups

Through the context menu of the “Managed computers” node (command “All tasks” - “Create group structure” in context menu) the hierarchy of computers can be generated automatically. For this purpose, information about the structure of domains and workgroups is used Windows network, Active Directory groups or content text file.

In the “Groups” panel, you can set the conditions for installing programs on computers newly added to the group. You can also specify the criteria by which the user’s computer will be assigned the “Warning” or “Critical” status. For example, if the databases have not been updated for more than X days or more than Y viruses have been found.

Figure 22. Setting criteria for setting statuses for computers

Once the groups have been created and configured, you can begin populating the groups with computers. To do this, use the “Computers” panel, in which you can add and remove computers on the “Administration Server”. You can also view information about each computer on the network - its status, the time the databases with signatures were updated, the number of viruses found, etc.

Figure 23. Computers panel with the filtering panel expanded

To add a new computer, you need to click on the “Add computers” button, after which the wizard window will appear. The first step is to determine how to add client computers.

Figure 24. Window of the Add Client Computers Wizard

When manually adding computers, you need to specify the IP address or range of IP addresses of computers on the network. You can also import a list from a text file with a list of IP addresses.

Figure 25. Manually adding new computers

When adding automatically, just specify necessary computers from the list of detected computers on the network.

Figure 26. Window for adding computers detected by the administration server

If for some reason the computers were not distributed into administration groups, they remain in the folders of the “Unassigned computers” node. You can also apply tasks and configure policies to these computers. New computers found by the administration server when polling the Windows network, IP addresses and Active Directory groups are also placed in these folders. After finding new computers on the network, the administrator can move them to one of the existing groups.

Installing applications via Kaspersky Security Center

Kaspersky Security Center allows you to install various programs on computers on your local network. These may be Kaspersky Lab customer protection programs or third-party programs. To install the program on a client computer, you must create a task of the appropriate type and specify the computers for which it will be executed.

Installing programs through Kaspersky Security Center is primarily necessary to deploy protection on client computers when starting to use Kaspersky Lab solutions in an organization and when adding new computers for protection.

To organize protection on client computers, you first need to install administration agents and Kaspersky Endpoint Security 8. The installation package is installed using the Remote Installation Wizard, which is launched from the “Groups” panel by clicking on the “Start installation” button. Select the administration agent and click the “Next” button.

Figure 27. Selecting the program to install

We indicate that the program is installed “From a shared folder”. After installing the Administration Agent, it is more convenient to carry out all installations through it, since in this case it is possible to centrally manage the installation repository. And when adding a new computer to the network, the administrator will be able to run one task to install the entire list of necessary programs.

Figure 28. Selecting program installation options

In the next step you can specify accounts with administrator rights.

Figure 29. Selecting accounts with administrator rights on the target computer

After this, you will need to choose whether to restart the computer after installing the program and, if so, whether to force it or ask the user. At this point, the creation of the program installation task is completed and you can run it.

Figure 30. Launching the application installation task

If for some reason installation over the network is not possible (for example, the network is disabled on the computer), then you can create an installation package and provide it to the user for independent installation.

New Web Console

The main advantages of Web Console compared to MMC:

No client-side installation required, just a web browser required

Since you only need a browser, it doesn’t matter what operating system

If you work on a mobile device, you can view reports directly from the beach

Web Console supports the User-Centric model, that is, the administrator assigns a policy not to the device, but to the user. The User-Centric management model works if devices are assigned owners in AD. KSC will be able to receive this information and assign policy profiles not to devices, but to device owners. The old Device-Centric management model, where policy profiles were assigned to devices, remains available and is the default.

Web Console is a separate distribution. It can be installed either on a computer with KSC or on a separate computer.

Interaction scheme:

Web Console is a web server based on the Node.js platform.

The Web Console server part connects to KSC using the new KSC Open API protocol based on HTTPs. The client part is an SPA (Single Page Application).

In its simplest form, SPA is a web application whose components are loaded once on the page, and the content is loaded as needed. Those. when we click on any interface element in the Web Console, JavaScript is launched, which loads modules and renders what we requested. And everything will look as if we went to another page.

Changes in the interface of the MMC administration console

Several new nodes have appeared in the console tree:

Multitenant applications – this may include LC applications that have Multitenancy support functionality, for example, KSV.

Deleted objects – this includes deleted entities, such as tasks, policies, installation packages

Triggering of rules in Smart Training mode – information about triggering of rules in the training mode for the new AAC component comes here

Active threats (previously called Unprocessed files)

So, what can go into the Deleted objects node. All entities that have a Revisions section in their properties go to the Deleted objects node after deletion.

Namely: - Policies - Tasks - Installation packages - Virtual Administration Servers - Users - Security groups - Administration groups

We can say that this is an analogue of the Recycle Bin in Windows.

General and end-to-end forKSC subnet list

In KSC, subnets can be used in multiple places. For example, in the properties of KSC, when we want to limit the transmission of traffic by time. In the Agent policy, when setting up connection profiles.

In KSC 10, it was necessary to separately set subnet parameters in each of these places, which was not very convenient.

In KSC 11, in the properties of the Administration Server appeared new section, where you can specify a list of subnets within the organization once and this list will be available anywhere in the KSC where you need to select a subnet as a parameter.

Installation package: protection level indicator

The KES 11.1 installation package in KSC 11 no longer has installation options.

But they added a protection indicator to the properties of the installation package; previously such an indicator was only in the policy. If the administrator decides to disable the installation of an important KES 11.1 component, the indicator will change color. You can also see what influenced the change in the level of protection.

KSC 11: supportdiff – update files

The update servers store several sets of databases, complete and so-called diff files (the difference (delta) between the current and previous update). Diffs can be daily or weekly. KSC 10 was able to download only the full set of databases, now it can download both sets, full and diffs.

The paradox is that KES has long been able to work with diffs, but only when updating from the Internet, now KES can use diffs when updating from KSC. This will significantly reduce internal traffic many times over.

Network Agents: supportdiff – update files

The option to download updates in advance (offline update mode) is enabled in the Agent policy by default

Diff file relay does not work when offline update mode is enabled

Diff files will not be transferred to older versions of Agents

BUT! In the Network Agent properties there is an option “Download updates from KSC in advance”. So, if this option is enabled, and it is enabled by default, then KES will be updated the old fashioned way without using diffs.

KSC 11: Update Agents

Update Agents can now also distribute DIFF update files.

In addition, they can now act as a KSN Proxy and can redirect KSN requests from protected devices to the Administration Server or directly to global KSN servers.

UpdateAgent: support 10,000 nodes

By default, KSC assigns Update Agents automatically.

In KSC 10, if the administrator wanted to assign the Update Agent manually, then in large networks this caused inconvenience. Why? Because previously one Update Agent could support up to 500 hosts. And if there are several thousand hosts on the network, then it was necessary to assign many Update Agents to cover the entire network. In addition, not any computer can become an Update Agent; it must meet certain system requirements.

In general, manually assigning an Update Agent in large networks used to be a difficult task.

Now this problem has disappeared, because... now one Update Agent supports up to 10,000 hosts.

Since the number of supported hosts has increased, the system requirements to a computer that can be assigned an Update Agent (processor frequency 3.6 GHz or higher, RAM from 8 GB, Volume free space on a disk from 120GB)

FolderKLSHARE has moved: C:\ProgramData\KasperskyLab\adminkit\1093\.working\share\

K.S.C. 11: Plugin Backward Compatibility KES

KSC11 introduces backward compatibility of KES plugins.

Previously, if they were used on the network different versions KES, the administrator had to maintain separate sets of policies and tasks for each version. Now the policies and tasks of KES 11.1 will apply to KES 11.

K.S.C. 11: remote installation

A new section has appeared in the Remote Installation Wizard - Behavior for devices managed through other Administration Servers.

If there are multiple KSC servers on the network, they can see the same devices. This option allows you to avoid installation on a device that is connected to another KSC.

KSC 11: improvements inRBAC

Firstly, RBAC no longer requires a license for the Administration Server.

Secondly, new roles have appeared: - Auditor - Security Officer - Supervisor. By default they are not assigned to anyone.

Thirdly, it became possible to relay the list of roles to subordinates of the Administration Server. Previously, you had to work with roles separately on each Server, which was not very convenient. Now you can create and configure roles in one place on the Main Administration Server and move them down the hierarchy.

KSC 11: new reports

Report on the status of application components– allows the administrator to clearly understand where which components are installed and their current status. This important information, because An installed but not running component reduces the effectiveness of end node protection. Previously, the administrator did not have the opportunity to view the status of KES components in one place on all devices at once. To find out which components were installed and running, we had to look at each host separately, which was inconvenient and time-consuming.

If necessary, based on this report, you can build detailed reports on individual components, for example, see where Endpoint Sensor is installed.

Reportonthreatdetectiondistributedbycomponentanddetectiontechnology- information about which particular protection component detected the threat and using what technology. This allows you to clearly demonstrate the operation of detection technologies and the usefulness of protection components.

Integration withSIEM via syslog

To send events from KSC to the SIEM system via the syslog protocol, a license is no longer required.

But this only applies to Syslog, integration with ArcSight, QRadar and Splunk still requires a license!

Diagnostics of update installationWindows

The option automatically enables Network Agent tracing. Trace files are stored in the folder - %WINDIR%\Temp

TOTALKSC 11:

A full-fledged KSC Web Console has appeared

Implemented support for DIFF update files

Implemented support for backward compatibility of KES plugins

Update agents can act as a KSN proxy and support up to 10,000 nodes

Adding new roles to RBAC does not require a KSC license

New reports added

Integration with SIEM systems via syslog no longer requires a license

Windows update installation diagnostics have been expanded

By choosing Kaspersky Lab products, you get reliable protection of your IT infrastructure and the ability to control security in your company using a single, convenient management console Kaspersky Security Center.

• System administration

Review

Previously, IT departments had to work simultaneously with multiple management consoles to manage multiple security tools and perform basic system administration functions. Kaspersky Lab has created a solution that simplifies the work of the administrator.

Easy to control
The main goal of creating Kaspersky Security Center was to simplify and speed up the setup, launch and management processes for IT security tools and systems in a complex IT environment. A single management console helps you control all the Kaspersky Lab security and system administration tools you use. With Kaspersky Security Center, you can control every workplace and every device on your network, centrally solve security problems, and reduce operational costs and increase productivity.

Intuitive interface
When developing Kaspersky Security Center, our specialists sought to provide the user with the most easy-to-use interface with clearly organized monitoring panels.

Easy installation
Using the installation wizard, you can quickly and easily install and configure Kaspersky Lab security solutions throughout your IT environment.

Remote access
In addition to the local management console, Kaspersky Security Center has a convenient web console. The presence of such a console allows you to use any computer with Internet access to monitor the security status of the corporate network.

Simple reporting
Kaspersky Security Center allows you to create and configure various reports on the protection status. Reports can be generated either on demand or according to a specified schedule.

Support for multi-platform environments
Working in the operating room Windows system, Kaspersky Security Center supports management of multiple operating systems and platforms, including servers and workstations under Windows control, Linux and Novell Netware, as well as mobile devices running Android control, iOS, BlackBerry, Symbian, Windows Mobile and Windows Phone.

How to get Kaspersky Security Center

Kaspersky Security Center is part of Kaspersky TOTAL Security for business and all Kaspersky Endpoint Security for business products: STARTER, STANDARD and ADVANCED. Kaspersky Security Center will include only those management tools that are necessary to work with the Kaspersky Lab product you have chosen. If you decide to upgrade to more high level Kaspersky Endpoint Security for business or up to complete solution Kaspersky TOTAL Security for Business, additional management tools will automatically appear in the Kaspersky Security Center management console.

Job security management

Installation, configuration and management of endpoint protection in Kaspersky Lab solutions are performed in Kaspersky Security Center. From a single console, you can manage and protect your business from known and emerging malware, prevent IT security risks, and reduce security costs.

• Antivirus protection and firewall
  Allows the administrator to audit the use of applications, allow or block their launch.
• Whitelists
  Kaspersky Security Center provides flexible management options for anti-malware protection:
  • Set and manage protection policies for multiple platforms, including Windows, Linux, and Mac;
  • configure protection settings for individual devices, groups of servers and workstations;
  • Perform anti-virus scans on demand and on a schedule;
  • process quarantined objects;
  • manage anti-virus database updates;
  • manage cloud Kaspersky protection Security Network;
  • Configure and manage firewall and intrusion prevention system (HIPS).
• Control of applications, devices and Web Control
  Centralized management of the IT infrastructure allows you to create security policies and provide additional protection for valuable data. You can set rules for groups and individual users.
  • restrict the launch of unwanted applications on your network using Application Control;
  • create access rules for devices that users connect to the network based on type or serial number device, as well as based on the method of connecting the device;
  • Monitor and control Internet access for the entire enterprise or groups of users.
• Protection file servers
  The only infected object from network storage capable of infecting a large number of computers. To avoid this, Kaspersky Security Center makes it possible to configure and manage all protection functions for file servers.
  • Control malware protection for file servers running:
    • Windows;
    • Linux;
    • Novell NetWare.
• Encryption
  Many encryption products are considered difficult to deploy and require a separate management console. All Kaspersky Lab encryption technologies can be managed from the same Kaspersky Security Center management console from which you manage other Kaspersky Lab security solutions.
  • You can create comprehensive policies that control encryption, anti-malware, device and program control, and other endpoint protection capabilities.
  • You can create comprehensive policies that control encryption, anti-malware, device and program control, and other endpoint protection capabilities.
    • hard drives(file and folder encryption or full disk encryption);
    • removable devices (file and folder encryption or full disk encryption).

Mobile device management

Needs for access to corporate systems mobile devices are growing, and Kaspersky Security Center helps protect them and ensure the safety of using personal devices for work.

• Mobile device protection management
  Kaspersky Security Center helps you deploy and configure protection for mobile devices:
  • configure mobile workplace protection, including creating security policies for iOS;
  • install and update software via SMS, email or via users' computers;
  • Monitor whether all users have fully deployed security controls on their devices;
  • control access to the corporate network;
  • set policies for groups or individual users using Active Directory;
  • configure ActiveSync settings.
• Malware protection
  Kaspersky Lab technologies provide comprehensive protection of mobile devices from malware, and Kaspersky Security Center helps you flexibly manage the functions of this protection:
  • Run malware scans on demand and on a schedule;
  • Use anti-spam tools to filter out unwanted calls and text messages (except iOS).
• Mobile Application Management
  Kaspersky Security Center allows you to control which programs can be launched on the user's Android mobile device:
  • use the "Default permission" mode to prevent only blacklisted applications from running;
  • use Deny by Default mode to allow only whitelisted programs to run;
  • create a policy to control cases of unauthorized flashing of devices
• Encrypting data on mobile devices
  In addition to managing data encryption in your IT infrastructure, Kaspersky Security Center also allows you to control data encryption on mobile devices:
  • manage full disk encryption on iOS devices;
  • configure encryption of files and folders.
• Containers
  Kaspersky Security Center allows you to manage the storage of corporate data on personal devices used for work:
  • configure containers to completely isolate corporate data from personal data on the user’s device;
  • manage container encryption;
  • control access of programs to certain resources on a mobile device;
  • set restrictions on access to data;
  • Use remote troubleshooting tools when you encounter problems with applications or containers.
• Anti-Theft
  Remote management using Kaspersky Security Center allows you to still control some important functions if your mobile device is lost or stolen:
  • remote blocking will prevent unauthorized access to your corporate network;
  • the search function allows you to determine the approximate location of the missing mobile device;
  • The wipe function gives you the choice to delete corporate data or restore factory settings.

When you purchase Kaspersky Endpoint Security for Business STANDARD, Kaspersky Endpoint Security for Business ADVANCED, Kaspersky TOTAL Security for Business, or Kaspersky Security for Mobile, all mobile device management capabilities will be available in Kaspersky Security Center. This way, you can use a single console to manage your mobile devices, endpoint protection, and many other Kaspersky Lab technologies.

System administration tools

In addition to detailed control over the security of the IT infrastructure, Kaspersky Security Center provides system administration tools that simplify infrastructure management tasks and increase productivity and reduce operational costs.

• Deployment of OS and programs
  Kaspersky Security Center allows you to manage OS and program images: create, quickly copy and deploy.
• Software installation
  The remote software installation feature in Kaspersky Security Center saves administrators time and helps reduce the amount of traffic transmitted over the corporate network.
  • Deploy software on demand or according to a schedule.
  • Using dedicated update servers
• License management and hardware and software accounting
  Kaspersky Security Center allows you to manage hardware and software, as well as track software licenses within your IT infrastructure:
  • Keep track of all devices on your network with automatic hardware inventory;
  • Monitor application usage and track license renewal issues using summary reports generated by Kaspersky Security Center.
• Vulnerability monitoring
  After inventorying your hardware and software, you can search for vulnerabilities in operating systems and applications that have not been patched:
  • generate detailed reports on vulnerabilities;
  • Perform vulnerability assessments and prioritize patches.
• Patch installation management
  Once you find vulnerabilities, you can efficiently distribute the most important patches using Kaspersky Security Center:
  • manage the download of patches from Kaspersky Lab servers;
  • Manage the installation of Microsoft updates and patches on computers on your network.
• Network access control
  Network access control not only provides automatic discovery of devices on the corporate network, but also simplifies setting policies for guest mobile devices:
  • manage policies for providing access to your corporate network from various devices;
  • Manage guest access to the Internet and corporate network resources.

All system administration tools will be available in your Kaspersky Security Center management console if you use Kaspersky Endpoint Security for Business ADVANCED, Kaspersky TOTAL Security for Business, or Kaspersky Systems Management.

Full list of supported applications:

Kaspersky Security Center provides management of the following Kaspersky Lab solutions for protection against information threats:

• mobile device protection:
  • Kaspersky Endpoint Security for Smartphone
• workstation protection:
  • Kaspersky Endpoint Security for Linux
  • Kaspersky Endpoint Security for Mac
  • Kaspersky Anti-Virus 6.0 for Windows Workstations MP4
  • Kaspersky Anti-Virus 6.0 Second Opinion Solution MP4
• server protection:
  • New! Kaspersky Endpoint Security for Windows
  • Kaspersky Anti-Virus for Windows Servers Enterprise Edition
  • Kaspersky Anti-Virus for data storage systems
  • Kaspersky Anti-Virus for Linux File Server
  • Kaspersky Anti-Virus 6.0 for Windows Servers MP4
  • Kaspersky Anti-Virus 5.7 for Novell NetWare
• protection of virtual environments:
  • New! Kaspersky Security for Virtualization

Please note that support for some versions of security solutions for Microsoft Exchange and ISA Server, as well as previous versions applications for protecting servers and workstations under Linux control is still carried out using Kaspersky Administration Kit, the previous version of the centralized management tool for the security system.

System Requirements

Administration Server

Administration Console

Web administration console server

Kaspersky TOTAL Security for Business includes all the features of Kaspersky Security Center. When using other Kaspersky Lab products, the set Kaspersky capabilities Security Center will depend on the functionality of the selected solution.

This material was prepared for specialists involved in management antivirus protection and safety at the enterprise.

This page describes and discusses the most interesting functionality of the latest versions of Kaspersky Endpoint Security 10 and the central management console of Kaspersky Security Center 10.

The information was selected based on the experience of communication by NovaInTech specialists with system administrators, heads of IT departments and security departments of organizations that are just switching to Kaspersky anti-virus protection, or are going through the process of switching from using the 6th version of the anti-virus on client computers and the Administration management console Kit 8. In the latter case, when anti-virus protection from Kaspersky Lab is already in use, it is also often the case that IT specialists do not know the most interesting aspects in the work of new versions of products that really help make life easier for these same IT specialists, and at the same time increase level of safety and reliability.

After reading this article and watching the videos, you can briefly familiarize yourself with the most interesting functionality that provides latest version management consoles of Kaseprky Security Center and Kaspersky Endpoint Security and see how it works.

1. Installation of the Kaspersky Security Center 10 administration server.

You can find the necessary distribution kits on the official Kaspersky Lab website:

ATTENTION! To the distribution full version Kaspersky Security Center already includes the latest version of Kaspersky Endpoint Security distribution kit.

First of all, I would like to talk about where to start installing anti-virus protection from Kaspersky Lab: Not with the anti-viruses themselves on client computers, as it might seem at first glance, but with the installation of the administration server and the central management console Kaspesky Security Center (KSC ). Using this console, you can deploy anti-virus protection on all computers in your organization much faster. In this video you will see that after installing and minimally configuring the KSC administration server, it becomes possible to create an installer for an anti-virus solution for client computers, which even a completely untrained user can install (I think every administrator has such “users”) - the installation interface contains only 2 buttons - “Install” and “Close”.

The administration server itself can be installed on any computer that is always on or is maximally accessible; this computer must be visible to other computers on the network, and it is very important for it to have access to the Internet (for downloading databases and synchronizing with the KSN cloud).

Watch the video, even if you have installed the center console before, but from previous versions - perhaps you will hear and see something new for yourself...

DID YOU LIKE THE VIDEO?
We do the same supply of Kaspersky products. And even more - we provide technical support. We care about our clients.

2. Setting up centralized management on computers with Kaspersky already installed.

It is often found that in small organizations, system administrators install and configure anti-virus protection on each computer manually. Thus, the time they spend on maintaining anti-virus protection increases and they do not have enough time for some more important tasks. There are cases when administrators, simply due to lack of time, simply do not know that corporate versions of anti-virus protection from Kaspersky Lab generally have centralized management, and do not know that there is no need to pay anything for this miracle of civilization.

In order to “link” already installed client antiviruses with the administration server, you need very little:

• Install the administration server (First section of this article).
• Install the administration server agent (NetAgent) on all computers - I will tell you about the installation options in the attached video below.
• After installing the Administration Server Agent, the computers, depending on your settings, will be either in the “Non-distributed computers” section or in the “Managed computers” section. If the computers are in “Not distributed computers”, they will need to be transferred to “Managed computers” and configure a policy that will apply to them.

After these steps, your computers will be visible to you from the central console, users will no longer be able to manage the antiviruses installed on their machines and, as a result, there will be fewer infections and less headaches for the administrator.

In the video below, I will try to describe scenarios for installing NetAgents on client computers, depending on how your network is structured.