Kaspersky Anti Targeted Attack Platform - Short Review

Overview of Kaspersky Anti Targeted Attack Platform (KATA)

The Kaspersky Anti Targeted Attack Platform (KATA) is a comprehensive cybersecurity solution designed to protect corporate IT infrastructures from sophisticated and targeted threats, including zero-day attacks, advanced persistent threats (APTs), and other complex targeted attacks.

Key Objectives

• Advanced Threat Detection: KATA combines network-level advanced threat discovery with Endpoint Detection and Response (EDR) capabilities to provide a unified solution for identifying and mitigating multi-dimensional threats.
• Unified Protection: The platform integrates with various Kaspersky security products, such as Kaspersky Endpoint Security for Business, Kaspersky Security for Mail Server, and Kaspersky Security for Internet Gateway, ensuring all potential threat entry points (network, web, mail, PCs, laptops, servers, and virtual machines) are under centralized control.

Key Features and Functionality

Multi-Layered Sensor Architecture

• KATA employs a multi-layered sensor architecture that includes network, web, email sensors, and endpoint agents to achieve all-round visibility and detect threats effectively.

Advanced Threat Discovery

• The platform utilizes extensive threat discovery engines that analyze data from network sensors and endpoint agents to provide rapid and accurate threat verdicts with fewer false positives.

Endpoint Detection and Response (EDR)

• At its core, KATA includes Kaspersky EDR Expert, which offers comprehensive visibility across all endpoints, automating routine EDR tasks and enabling analysts to efficiently hunt, prioritize, investigate, and neutralize complex threats.

Network Detection and Response (NDR)

• The latest version of KATA includes enhanced NDR functionality, featuring real-time monitoring and threat detection within the network. This includes Transport Layer Security (TLS) fingerprinting to analyze internal and external traffic without decryption, helping to detect and mitigate security threats.

Advanced Sandbox

• The platform provides a safe environment for deep analysis of threat activity using advanced sandbox technologies, including OS component randomization, time acceleration in virtual machines, anti-evasion techniques, and user activity simulation. Results are mapped to the MITRE ATT&CK knowledge base for highly efficient behavior-based detection.

Threat Intelligence and Hunting

• KATA leverages advanced threat intelligence, allowing for automated comparison with global reputation data from the Kaspersky Security Network and manual threat hunting through the Kaspersky Threat Intelligence Portal. It also supports real-time automatic threat hunting using Indicators of Attack (IoAs) correlated with the MITRE ATT&CK matrix.

Automation and Efficiency

• The platform automates manual tasks during threat detection and response, simplifies threat analysis and incident response, and reduces the time taken to identify and respond to threats. This frees up IT security personnel for other critical tasks and helps eliminate security gaps and reduce attack dwell time.

Regulatory Compliance

• KATA supports full regulatory compliance, ensuring that corporate infrastructure security and business processes adhere to necessary standards without demanding additional IT security resources.

Operational Benefits

• Centralized Response: Provides a rapid and centralized response to threats, enhancing the efficiency of IT security or SOC teams.
• Proactive Threat Hunting: Enables proactive threat hunting with powerful and flexible tools.
• Flexible Licensing: Offers more flexible subscription-based licensing support, particularly beneficial for Managed Security Service Providers (MSSPs).

In summary, the Kaspersky Anti Targeted Attack Platform is a robust and integrated solution that enhances cybersecurity defenses by combining advanced threat detection, EDR, and NDR capabilities, all while simplifying and automating threat response processes to protect corporate IT infrastructures effectively.