1. Ransomware & Security for Virtualization
Zack Ehrhardt Kaspersky Lab

2. RANSOMWARE BY THE NUMBERS3x
Ransomware attacks on businesses increased threefold Attacks on small businesses increased eightfold* Frequency of ransomware attacks on businesses Cost of a single cryptomalware attack for SMBs Enterprises in NA who suffered four or more data breaches in the past year** The cost of a single cybersecurity incident for large businesses 8x
Every 40
seconds
$99,000
44%
$861,000

3. HOW DO WE GET INFECTED WITH RANSOMWARE?
Source: Osterman Research, Inc.

4. NO MORE RANSOM
Founding partners: European Cybercrime Centre, Politie, Intel Security and Kaspersky Lab
Additional partners: Over 30 organizations in security, cloud services and law enforcement
Goal: Help ransomware victims retrieve their encrypted data without paying the criminals
Project aim: Prevent ransomware by educating users about prevention

5. Kaspersky Security for Virtualization

6. Dilbert’s Take on Virtualization

7. Basic Theory for Security
Chance of getting infected
Investment in Security
The chance of getting infected drops exponentially by increasing the investment in security

8. Kaspersky Security Center
IT security in a single-pane-of-glass view
All protected machines – Virtual / Physical / Mobile
Protection status at a glance with actionable intelligence

9. Excessive resource consumption Update storms Instant-On gaps
Agent-based Security in a Virtual Environment
Redundant
Excessive resource consumption
Update storms
Instant-On gaps
Lower VM densities
Each guest protects itself - Antimalware stored locally on each VM. Requires a separate process to scan each VM

10. Is there a better way to protect virtualized environments from malware?

11. Aligning the Security approach to the environment
Traditional
Agent-Based
Works on any hypervisor
Where VM density is not critical
Windows, Linux or Mac guest VMs
Offers anti-cryptor feature for file servers
Agentless
Security
VMware only
Allows high VM density
Windows guest VMs only
Small IT resources to manage security
Typical installation would be server virtualization with no/or controlled internet connectivity (limited browsing)
Light Agent
Security
VMware, Hyper-V, Citrix, or KVM
Allows high VM density
Windows and Linux guest VMs
Advanced security requirements:
IM, Web and Mail AV
Application, Web and Device controls
Automatic Exploit Protection
Typical usage would be VDI and servers with critical Internet facing roles

12. Enterprise class failover
Light Agent Security
Keeps consolidation ratio high
Still easy to deploy and manage
No problems of Agent-based security
VMWare, Citrix, Microsoft, KVM
Advanced protection
Enterprise class failover
LIGHT AGENT
Advanced antimalware
Advanced protection from network threats
Controls
SECURITY VIRTUAL APPLIANCE
Anti-malware databases
Centralized file scanning
KSV | Security Options

13. SECURITY VIRTUAL APPLIANCE
Agentless Security
Eliminate redundant security
Reduce boot latency
Keeps consolidation ratio high
Extremely easy to deploy and manage
Agent-based security issues eliminated, but..
File scanning security
Only VMware
Excessive resource consumption
Update storms
Instant-On gaps
Lower VM densities
Every VM get basic protection automatically w/o installation of any additional software
SECURITY VIRTUAL APPLIANCE
Anti-malware databases
Centralized file scanning

14. 2 Simple Takeaways… Be proactive when protecting against ransomware
Choose the right security option for your virtual environment

15. Thank you!