Although the number of threats targeting Linux is lower compared to those targeting other platforms, attacks against it are on the increase: there are more than 100,000 malicious files registered in Kaspersky Lab databases.
Kaspersky Endpoint Security for Linux provides next-generation, multi-layered protection against all types of cyberthreats, on the widest range of Linux platforms. It delivers reliable protection with minimal impact on performance. It’s available within our comprehensive product portfolio – including Kaspersky Endpoint Security for Business and Kaspersky Hybrid Cloud Security – and provides complete protection in hybrid environments, ensuring all systems are managed and protected all the time.
Kaspersky Endpoint Security for Linux provides built-in technologies to:
Kaspersky Endpoint Security for Linux is built on the world's most tested, most awarded security. It combines the best of human expertise with big data threat intelligence and machine learning. Multiple layers of security detect known and advanced threats, even in memory or boot sectors.
Rapid response to zero-day malware is a critical part of Kaspersky's cybersecurity capabilities. Kaspersky Security Network (KSN) is our advanced cloud system that processes anonymized threat data from millions of nodes worldwide, using sophisticated data science technologies to deliver near real-time threat intelligence to every user.
This agility means that even in zero-day attack situations, where threat information is not yet available to the endpoint, KSN works with Kaspersky Endpoint Security for Linux to stop threats. Big data processing of massive volumes of threat metadata from suspicious files makes it possible to make rapid, accurate decisions about their safety without having to completely analyze their content – with short response times, it's a significant additional layer of security for *nix endpoints.
Behavior Detection provides proactive defenses, identifying and extracting suspicious behavior patterns and effectively protecting your system against advanced threats.
Auto-scan for newly connected storage devices doesn't allow malicious programs that exploit operating system vulnerabilities to replicate themselves via removable drives.
Our Network Threat Protection helps to prevent network threats – including port scanning, denial-of-service attacks and buffer-overruns. It constantly monitors network activities and, if it detects suspicious behavior, runs pre-defined responses.
Our Web Threat Protection delivers a near-100% threat detection rate incorporated in the web traffic and blocking blocks harmful scripts.
Web Threat Protection monitors web traffic for attempts to visit phishing websites – and blocks access to them. To check links on webpages for phishing threats and malicious web addresses, Kaspersky Endpoint Security uses the application databases, heuristic analysis and data from Kaspersky Security Network.
Application control is one of the most effective and least resource-demanding technology that helps to drastically reduce the area of attack. Our application control allows you to implement denylist and allowlist modes to either manually block specific unwanted applications, or block all the applications that are not a part of the allowed subset. To simplify the management of application control, the administrator can assign categories to applications. It is also possible to fine-tune the operation by setting up user- or user-group based control rules.
Device control reduces your attack surface and helps keep users safe and compliant with security policies.
Configure and manage built-in Linux OS firewall settings: Kaspersky Endpoint Security for Linux enables the creation of firewall rules policy, network activity logs and security incident review from one place.
Enforce network policies to all endpoints from Kaspersky Security Center, your single point of security management and control.
Kaspersky Security for Linux contains a unique anti-cryptor mechanism capable of blocking encryption of files on shared resources from a malicious process running on another machine on the same network. This system constantly watches over the protected shared folders, tracking the state of the stored files. As soon as encryption activity is detected, the system blocks the attack source machine from accessing the server, stopping the encryption process and preventing the loss of corporate data.
The safety of sensitive data is at the top of every business's security agenda. Kaspersky Security for Linux supports this with essential functionality to strengthen security and aid compliance with key principles such as PCI DSS and SWIFT usage requirements. The File Integrity Monitor can guarantee the integrity of system files, logs and critical applications by tracking unauthorized changes in important files and directories.
Whether for compliance purposes or just because a routine security audit is coming up, you can create an inventory of executables on your Linux workloads. The list of executables can also be used to set up the application control rules.
Kaspersky Endpoint Security for Linux enables run-time protection from threats, on-demand scanning of containers, images and repositories as well as flexible integration into CI/CD pipelines.
Simplified container-based deployment allows you to quickly set up a threat-scanning service for your development environment. REST API and pipeline scripting examples make automation straightforward and helps ensure safe development practices.
Secure containerization environments ensure safer development, packaging and publishing of applications. Kaspersky Endpoint Security for Linux packs extensive security for containerization platforms and engines, such as Docker, CRI-O, Podman, and runC, enabling On-Access Scan (OAS) for File Threats, providing real-time Behavioral Protection to prevent exploitation, privilege escalation and container escape attempts. Namespaces are supported for threat-carrying entity isolation and granular control of actions that are taken on the abusing entity on detection.
On-Demand Scanning of containers, images and both local and remote repositories allows you to maintain sanitized repos for devs’ needs. Namespace monitoring, flexible mask-based scan scope control and the ability to scan different layers of containers help enforce secure development best practices.
Kaspersky Endpoint Security for Linux provides interfaces to enable a “security as code” approach. Paired with ODS, Kaspersky Endpoint Security for Linux enables transformation of DevOps into DevSecOps, helping combine lean software practices and Just-In-Time application building, packaging and delivery in a controlled and secure way without slowing down the processes.
CI/CD platform integrations (e.g. Jenkins) simplify pipeline building and automation.
Kaspersky Endpoint Security for Linux is specifically designed to have minimal impact on other programs and overall system performance. The graphical user interface is optimized for Linux and together with improved command line management capabilities, this simplifies task execution and daily reporting.
Load balancing of resources and optimized scanning technology – with the option to exclude trusted processes – enhances overall performance while reducing system requirements for protection. (System resources are reallocated when PC or server load is low or heavily loaded). Kaspersky Endpoint Security for Linux provides exceptional scanning performance with fanotify (kernel internal object) compatibility for on-access scanning.
Security scanning can be performed in background mode while server software is being updated, helping to reduce server downtime.
Kaspersky Endpoint Security for Linux optimizes resource usage with on-demand and scheduled scanning of local hard disks, media drives, shared file systems and distributed file systems.
A wide range of settings ensures high protection levels without sacrificing performance, for example:
Kaspersky Endpoint Security for Linux monitors and controls network shares and scans automatically when files are changed, ensuring that resources are optimized.
Spend less time and fewer resources managing IT assets and security: Kaspersky Security Center's 'single pane of glass' console provides powerful security controls and management for all Linux endpoints.
Generate reports, configure group or individual tasks and universal policies, manage scan settings, etc., from the same console that manages Kaspersky security for other platforms, including Windows, Mac OS and Android.
Application installation takes just a few minutes on x86 and x64 platforms and requires only one package. No additional compatibility packages are required to run on x64 workstations or servers.
It's not necessary to reinstall or setup following kernel updates on workstations or servers – reliable protection against malware is up and running without the need for administrator involvement.
Customize Linux protection across your business in a structured, efficient way using Kaspersky Security Center for group tasks policies, and policy profiles. Different types of tasks and task priority control help to fine-tune your security.
Three management options are available:
Kaspersky Endpoint Security for Linux is included in the following products: