protecting the mac environment: technical insight

|

Protecting the Mac Environment:

Technical insight

Nikolay Grebennikov, CTO, Kaspersky Lab

Kaspersky Security for Mac Launch Event, Moscow, 14-16 May 2012

|

Such a lovely device

Million users

Market share

US market share

100

5%

14%0

20

40

60

80

100

Desktop Apple Mac Laptop Apple MacBook

85%

56%

84%

50%

Anti-virus software usersAccording to Harris Interactive research, March 2012

1

Protection with

Kaspersky Lab

technologies

1PAGE 4 |

Kaspersky Lab technologies for Mac

KasperskySecurity NetworkEnhanced

File Anti-Virus

Heuristic AV & Script Emulator

NEWParental Control

NEWWEB Anti-Virus

NEWVirtual Keyboard

URL Advisor

1PAGE 5 |

Benefits of the Cloud

Services

Statistics

Kaspersky

Security for MAC

Kaspersky

Security Network

Blocking new threats Minimal reaction time

KSNEnhanced

1PAGE 6 |

Kaspersky Security Network services

Millions of users from 213 countries

Urgent updates regarding new threats

File reputation

URL reputation

Malware detection statistics

KSNEnhanced

1PAGE 7 |

Cloud protection: how it works

Malware

discovered

Update

created

Seconds

Update

ready for

download

Update

downloaded, cu

stomer

protected

Hours

KSNEnhanced

No CloudCloud

1PAGE 8 |

Effective Hybrid Approach

o Collects malware data from PCs

o Reacts fast to new threats

o No need to store data on PC

o Works when you are offline

o Analyzes and collects behavior patterns

o Remediates and rolls back malware actions

Cloud based technologies

Mac based technologies

Hybrid approach

KSNEnhanced

1PAGE 9 |

Even better than just a cloud

Faster protection against new threats

Limited data transfers to the cloud

Limited number of updates

Fastest possible reaction time

KSNEnhanced

1PAGE 10 |

Application control with Traffic Monitor

Application Internet server

Redirection

Proxy

Protocol parsing

TCP connect

Traffic monitor

NEWWEB Anti-Virus

1PAGE 11 |

Traffic Monitor - an essential part of protection

Network connections intercepted in kernel mode

Routed to local proxy

Protocol parsing

File and URL verification

1PAGE 12 |

Safe Internet with Web anti-virus

URL

Verification in the cloud

Offline bases verified

Heuristic scanning

WEB anti-virus

KSN

Signature scanning

NEWWEB Anti-Virus

1PAGE 13 |

Rich, Effective Web anti-virus functionality

Multi-level checking in the Cloud

Advanced heuristic engine

Complete signature bases with the full set of known malicious

scripts

1PAGE 14 |

Script emulation for safe browsing

Web page

open

Java script

JavaScript engine

Signature database

Script emulation

Web page

ready

Heuristic AV& Script Emulator

1PAGE 15 |

Emulation technology: Key elements

Specialized virtual environment

JavaScript emulation

Iframe content verification

Utilization of signature database

1PAGE 16 |

Backed up by even more technologies …

Protocol parsing

Traffic monitor

• AV bases

• PE emulator

• Script emulator

• iSwift

• UDS for files

• Anti-phishing bases

• Heuristics

• UDS for URLs

• Web control

• Time control

• Personal data protection

• Social networks protection

1PAGE 17 |

Efficient technologies = Efficient protection

Defense against new threats

Minimum reaction time

Network connection interception

Keeps your children safe online

Safeguards your private data

|

The better the user understands the protection concept,

the better that user is protected

This applies to Mac users as well

|

Thank you!

Questions?

Nikolay Grebennikov, CTO, Kaspersky Lab

Kaspersky Security for Mac Launch Event, Moscow, 14-16 May 2012

protecting the mac environment: technical insight

Technology