Kaspersky Anti Targeted Attack Platform

About risks of the Vulnerability category

Vulnerability risks are registered when the application detects vulnerabilities in monitored devices on the corporate LAN. A vulnerability is a flaw in the software or hardware of a device, which an attacker can exploit to compromise the information system or gain unauthorized access to information.

The application detects vulnerabilities by analyzing the available device information. Information that can help identify a known vulnerability for a device is compared against certain fields in the database of known vulnerabilities. The database of known vulnerabilities is built into the application. This database, maintained by Kaspersky experts, contains information about the most relevant or the most frequently encountered device vulnerabilities.

The database of known vulnerabilities contains descriptions of vulnerabilities and of devices that are affected by these vulnerabilities. In addition, the database contains recommendations for protecting the system in the form of texts or links to public resources. The database of known vulnerabilities contains descriptions and recommendations from various sources, which may include vendors of devices and software, as well as various security organizations. The descriptions and recommendations in the database are in English.

After the application is installed, the original database of known vulnerabilities is used. You can keep your database up to date by installing updates.

Kaspersky Anti Targeted Attack Platform compares the available information about devices with fields in the database of known vulnerabilities that describe the devices that are affected by the vulnerabilities. The application uses the following device information to detect vulnerabilities:

• Hardware vendor.
• Hardware model.
• Hardware version.
• Software vendor. If no software vendor information can be found in the device information, Kaspersky Anti Targeted Attack Platform reuses the Hardware vendor value.
• Software name. If the software name cannot be found in the device information, Kaspersky Anti Targeted Attack Platform reuses the Hardware model value.
• Software version.

In the database of known vulnerabilities, device descriptions are stored in the CPE (Common Platform Enumeration) format. The application compares the available device information with these descriptions, automatically converting the information to the CPE format. For each vulnerability, the content of the matching descriptions is listed in the risk details area in the Matched CPE section.

The main parameter that identifies a vulnerability is its ID in the Common Vulnerabilities and Exposures (CVE) list. This identification number is called the CVE ID. If a vulnerability does not yet have a CVE ID, an ID obtained from other public resources with descriptions of vulnerabilities is specified.

The Kaspersky Anti Targeted Attack Platform supports getting IDs and links to descriptions of vulnerabilities provided by the Federal Service for Technical and Export Control (FSTEC) of Russia in the Information Security Threats Databank (hereinafter also referred to as the "BDU"). If the downloaded vulnerability information contains such information from FSTEC's BDU, the application displays this information in the form of corresponding IDs in the "BDU:<year>-<number>" format.