Kaspersky Anti Targeted Attack Platform

Protecting against compromise of secrets when connected to remote devices

Identification and authentication details from secrets should be used only for remote connections to devices that are selected for active polling jobs. To protect this information against possible compromise in cases of device spoofing, the application verifies the public key received from the device before sending the information. The device uses the public key to establish SSH connections. A public key helps the application to verify that the SSH connection is being established with the correct device. Identification and authentication details are sent to the device after verifying that the received public key matches the public key saved in the application.

The saved public key of the device is displayed in the details area of the selected device on the General tab.

Receiving and saving public keys of devices in the application

By default, no public keys of devices are configured in Kaspersky Anti Targeted Attack Platform. A device's public key is received and saved when an SSH connection is established with this device for the first time for the purpose of scanning as part of an active polling job that uses a connector of the Active poll type. Identification and authentication details from the selected secret are sent to the device without checking the received public key. Therefore, before starting the active polling job for the first time for the selected device and establishing an SSH connection to it, make sure that there is no spoofed device on the network. To do this, you can run ifconfig to check that the IP addresses of the device configured in the application match the IP addresses on the network interfaces of the actual device.

Resetting saved device public keys

SSH connection keys on devices may change with time. Device users may generate new keys when their current private keys are at a risk of compromise.

When the private key is changed on the device, the public key is changed as well. After changing the public key, the application stops sending information from the secrets to this device because the new public key no longer matches the one saved in the application. Therefore, any subsequent device scans as part of active polling jobs finish with an error.

After changing the public key on the device, you must reset the currently saved public key for this device stored in the application. This will allow the secrets to be used again when connecting to the device remotely.

After resetting the saved public key, the application saves the newly received public key the next time an SSH connection is established with this device. Check that there is no spoofed device on the network, similarly to when initially receiving and storing a public key.

Only users with the Senior security officer role can reset saved public keys of devices.

To reset saved device public keys:

1. Use the web interface to connect to the Central Node with the Senior security officer role.
2. Select the Assets section.
3. On the Devices tab, select the devices for which you want to reset saved public keys.
4. Right-click one of the selected devices to open the context menu.
5. In the context menu, select Reset public key.

   This opens a confirmation prompt window.

6. In the prompt window, click OK.