Remote application administration using Kaspersky Security Center Web Console and Kaspersky Security Center Cloud Console

This section contains information about managing Kaspersky Embedded Systems Security using Kaspersky Security Center Cloud Console and Kaspersky Security Center Web Console.

This description is provided for Kaspersky Security Center 14.2.

The Kaspersky Security Center Cloud Console is the cloud version of Kaspersky Security Center. This means that the Administration Server and other components of Kaspersky Security Center are installed in the cloud infrastructure of Kaspersky. Kaspersky Security Center Cloud Console is managed using the cloud-based Administration Console called Kaspersky Security Center Cloud Console. Interface of this console is similar to Kaspersky Security Center Web Console interface. For detailed information about Kaspersky Security Center Cloud Console, refer to the Kaspersky Security Center Cloud Console documentation.

Kaspersky Security Center Web Console (hereinafter also referred to as "Web Console") is a web interface for managing a protection system based on Kaspersky applications. You can work in Kaspersky Security Center Web Console using a browser on any device that has access to the Administration Server. For detailed information about Kaspersky Security Center Web Console, refer to Kaspersky Security Center documentation.

Kaspersky Security Center Web Console lets you do the following:

• Monitor the status of your organization's security system.
• Install Kaspersky applications on devices within your network.
• Manage installed applications.
• View reports on the security system status.

Kaspersky Embedded Systems Security is managed using Kaspersky Security Center Cloud Console and Kaspersky Security Center Web Console by means of Kaspersky Embedded Systems Security web administration plug-in.

To manage Kaspersky Embedded Systems Security operation using Kaspersky Security Center Cloud Console or Kaspersky Security Center Web Console, assign the devices, on which Kaspersky Embedded Systems Security is installed, to

Logging in and out of the Web Console and Cloud Console

Kaspersky Security Center Web Console

To log in to the Web Console, you need to know the web address and the port number of the Administration Server specified during the Web Console installation (port 8080 is used by default). JavaScript must also be enabled in your browser.

To log in to Web Console:

1. In your browser, go to the <Administration Server web address>:<port number> address.

   The login page is displayed.

2. Enter the user name and password for your account.

   It is recommended to make sure that the password complexity and anti-bruteforce mechanisms ensure that the password cannot be guessed within 6 months.

3. Click Log in.

   If the Administration Server is not responding, or if you enter incorrect credentials, an error message is displayed.

After logging in, a dashboard is displayed with the last language and theme used.

For more details about the Web Console interface, refer to Kaspersky Security Center documentation.

To log out of Web Console:

select <Account name> → Exit in the lower left corner of the screen.

The Web Console is closed, and the login page is displayed.

Kaspersky Security Center Cloud Console

For the Kaspersky Security Center Cloud Console, use a web token to log in to your account on the Cloud Console portal.

For detailed information about Kaspersky Security Center Cloud Console, refer to the Kaspersky Security Center Cloud Console documentation.

Starting and stopping the application on a client device

After installing Kaspersky Embedded Systems Security to a user device, the application is started automatically. Subsequently, the application is launched by default immediately after the operating system starts.

You can monitor the application operation status by using the Protection status web widget in the Monitoring and reports / Dashboard window.

To start or stop the application remotely:

1. In the main window of the Web Console, select Devices → Managed devices.

   The list of managed devices opens.

2. In the list, select the device on which you want to start or stop the application, and click the link with the device name to open the device properties window.
3. Select the Applications tab.
4. Select the Kaspersky Embedded Systems Security 3.3 for Linux check box.
5. Click the Start or Stop button.

Viewing the protection status of a device

To view the protection status of a device:

1. In the main window of the Web Console, select Devices → Managed devices.

   The list of managed devices opens.

2. In the list, select the device for which you want to view information, and click the link with the device name to open the device properties window.
3. On the General tab, select the Protection section.

The Protection section displays the following information about the selected device:

• Visible in the network is the visibility of the selected device in the network: Yes or No.
• Device status represents a current status of the selected device, such as OK, Critical, or Warning.
• Status description represents the reasons for changing the status of the device to Critical or Warning.
• Protection status represents a status of the File Threat Protection task, such as Running, Stopped, or Paused.
• Last full check represents date and time when the last full scan task was completed on the selected device.
• Viruses detected represents a total number of malicious objects detected on the selected device (detected threat counter) since Kaspersky Embedded Systems Security was installed.
• Objects that failed disinfection represents a number of infected objects that Kaspersky Embedded Systems Security was unable to disinfect.

Updating application databases and modules

Updating the databases and application modules of Kaspersky Embedded Systems Security ensures up-to-date protection on your device. New viruses, malware, and other types of threats appear worldwide on a daily basis. Kaspersky Embedded Systems Security databases contain information about threats and ways of neutralizing them. To detect threats quickly, you are urged to regularly update the application databases and modules.

The following objects are updated on users' devices:

• Application databases. Application databases include databases of malware signatures, a description of network attacks, databases of malicious and phishing web addresses, databases of banners, spam databases, and other data.
• Application modules. Module updates are intended to eliminate vulnerabilities in the application and to improve methods of protecting devices. Module updates may change the behavior of application components and add new capabilities.

Kaspersky Embedded Systems Security supports the following scenarios for updating databases and application modules:

• Update from Kaspersky servers. Kaspersky update servers are located in different countries around the world, which ensures a high reliability of updates. If an update cannot be performed from one server, Kaspersky Embedded Systems Security switches over to the next server.
• Centralized update Centralized update reduces external Internet traffic, and provides for convenient monitoring of the update.

  Centralized update consists of the following steps:

  1. Download the update package to a repository within the organization's network.

     The update package is downloaded to the repository by the Download updates to Administration Server repository task of the Administration Server.

  2. Distribute the update package to client devices

     The update package is distributed to the client devices by the Update task of Kaspersky Embedded Systems Security. You can create an unlimited number of update tasks for each administration group.

For the Web Console, by default, the list of update sources contains Kaspersky update servers and Kaspersky Security Center Administration Server. For the Kaspersky Security Center Cloud Console, the default list of update sources contains distribution points and Kaspersky update servers. For more details about distribution points, refer to Kaspersky Security Center Cloud Console documentation.

You can add other update sources to the list. You can specify FTP-, HTTP-, or HTTPS servers as update sources. If an update cannot be performed from an update source, Kaspersky Embedded Systems Security switches to the next update source.

Updates are downloaded from Kaspersky update servers or from other FTP, HTTP, or HTTPS servers over standard network protocols. If connection to a proxy server is required to access the update sources, specify the proxy server settings in the Kaspersky Embedded Systems Security policy settings.

Updating from the Administration Server repository

To save Internet traffic, you can configure updates of application databases and modules on devices on the organization's LAN from a server repository. To do this, in Kaspersky Security Center you need to configure downloading the update package from Kaspersky update servers in the Administration Server repository. Other devices on the organization's LAN will be able to receive the update package from the server repository.

Configuring application database and module updates from the server repository consists of the following steps:

1. Download application databases and modules to the Administration Server repository using the Download updates to the Administration Server repository task of Kaspersky Security Center.
2. Configure updates of application databases and modules from the Administration Server repository on the remaining hosts using the Update task.

To configure updates of application databases and modules from the Administration Server repository:

1. In the main window of Web Console, select Devices → Tasks.

   The list of tasks opens.

2. In the list of tasks, select the Update task for Kaspersky Embedded Systems Security and click the link with the task name to open the task properties window.

   The Update task is created automatically by the Web Console Initial Setup Wizard. To create the Update task, install Kaspersky Embedded Systems Security web plug-in while running the Wizard.

3. In the task properties window, select the Application settings tab.
4. In the list on the left, select the Database update source section.

   The task settings are displayed in the right part of the window.

5. In the Database update source section, select the Kaspersky Security Center Administration Server option.
6. Select the Use Kaspersky update servers if other update sources are not available check box if you want to the Update task to use Kaspersky update servers if the Administration Server repository is unavailable.
7. Click Save.

Updating using Kaspersky Update Utility

To reduce Internet traffic, you can configure updates of application databases and modules on devices of the organization's LAN from a shared directory by using the Kaspersky Update Utility. For this purpose, one of the devices in the organization's LAN must receive update packages from the Kaspersky Security Center Administration Server or from Kaspersky update servers and use the utility to copy the received update packages to the shared directory. Other devices on the organization's LAN will be able to receive the update package from this shared directory.

Configuring application database and module updates from a shared directory consists of the following steps:

1. Install Kaspersky Update Utility on one of the devices of the organization's LAN.
2. Configure copying of the update package to the shared directory in the Kaspersky Update Utility settings.
3. Configure application database and module updates from the specified shared directory to the remaining devices on the organization's LAN.

You can download the Kaspersky Update Utility distribution kit from the Kaspersky Technical Support website. After installing the utility, select the update source (for example, the Administration Server repository) and the shared directory to which the Kaspersky Update Utility will copy update packages. For detailed information about using Kaspersky Update Utility, refer to the Kaspersky Knowledge Base.

To configure updates from a shared directory:

1. In the main window of Web Console, select Devices → Tasks.

   The list of tasks opens.

2. In the list of tasks, select the Update task for Kaspersky Embedded Systems Security and click the link with the task name to open the task properties window.

   The Update task is created automatically by the Web Console Initial Setup Wizard. To create the Update task, install Kaspersky Embedded Systems Security web plug-in while running the Wizard.

3. In the task properties window, select the Application settings tab.
4. In the list on the left, select the Database update source section.

   The task settings are displayed in the right part of the window.

5. In the Database updates source section, select the Other sources on the local or global network option.
6. In the table of update sources, click the Add button.
7. In the Update source field, specify the path to the shared directory.

   The source address must match the address indicated in the Kaspersky Update Utility settings.

8. Select the Use this source check box and click OK.
9. In the table, set the order of the update sources using the Up and Down buttons.
10. Click Save.

Using a proxy server for updates

You may be required to specify proxy server settings to download database and application module updates from the update source. If there are multiple update sources, proxy server settings are applied for all sources. If a proxy server is not needed for some update sources, you can disable the use of a proxy server in Kaspersky Embedded Systems Security policy settings. The application will also use a proxy server to access Kaspersky Security Network and activation servers.

To enable use of a proxy server for a specific administration group:

1. In the main window of the Web Console, select the Devices → Policies and profiles tab.
2. In the list of policies, select the Kaspersky Embedded Systems Security policy for the administration group on whose devices you want to disable the use of a proxy server. Click the link with the policy name to open the policy properties window.
3. In the policy properties window, select the Application settings tab.
4. Select the General settings → Proxy server settings section.
5. In the Proxy server settings section, select the Use specified proxy server settings and specify the required proxy server settings.
6. Click OK.
7. Click Save.

Managing policies in the Web Console

A policy is a set of Kaspersky Embedded Systems Security operation settings applied to an administration group. You can use policies to apply identical Kaspersky Embedded Systems Security settings to all client devices within an administration group.

Multiple policies with different values of the settings can be configured for a single application. However, there can be only one active policy at a time for an application within an administration group. When you create a new policy, all other policies within an administration group become inactive. You can change the policy status later.

Policies have a hierarchy, similarly to administration groups. By default, a child policy inherits the settings from the parent policy. A child policy is a policy of a nested hierarchy level, that is, a policy for nested administration groups and secondary Administration Servers. You can enable inheritance of the settings from the parent policy.

You can locally modify the values of the settings specified by the policy for individual devices within the administration group, if modification of these settings is not prohibited by the policy.

Each policy setting has a "lock" attribute that indicates whether child policy settings and local application settings can be modified. The "lock" status of a setting within a policy determines whether or not an application setting on a client device can be edited:

• When a setting is "locked" (), you cannot edit the setting locally. The setting value specified by the policy is used for all client devices within the administration group.
• When a setting is "unlocked" (), you can edit the setting locally. For all client devices in the administration group, the settings specified locally are used. The settings specified in the policy are not applied.

After the policy is applied for the first time, the application settings change in accordance with the policy settings.

You can perform the following operations with the policies:

• Create a policy.
• Edit policy settings.

  If the user account which is used to access the Administration Server does not have permissions to edit the settings of certain functional scopes, the settings of these functional scopes are not available for editing.

• Delete a policy.
• Change a policy status.
• Copy and move a policy.
• Export and import a policy.
• Compare policy versions in the Revision history section of the policy properties window.

You can also create policy profiles. A policy profile may contain settings that differ from the "base" policy settings and apply to client devices when the configured conditions (activation rules) are met. Using policy profiles allows you to flexibly configure operation settings for different devices. You can create and configure profiles in the Policy profiles section of the policy properties.

For general information on working with policies and policy profiles, refer to Kaspersky Security Center documentation.

Creating a policy

To create a policy:

1. In the main window of the Web Console, select Devices → Policies and policy profiles.

   The list of policies opens.

2. Select the administration group containing client devices to which the policy should be applied. To do so, click the link in the Current path field in the upper part of the window and select an administration group in the window that opens.

   The list displays only the policies configured for the selected administration group.

3. Click Add.

   The Policy Wizard starts.

4. Select Kaspersky Embedded Systems Security 3.3 for Linux and click Next.
5. Decide whether you want to participate in Kaspersky Security Network. Carefully read the Kaspersky Security Network Statement and do one of the following:
   • If you agree with all the terms and conditions of the Statement and want the application to use Kaspersky Security Network, select I confirm that I have fully read, understand, and accept the terms and conditions of Kaspersky Security Network Statement.
   • If you do not want to use Kaspersky Security Network, select I do not accept the terms and conditions of the Kaspersky Security Network Statement and confirm your decision in the window that opens.

   Refusal to use Kaspersky Security Network does not interrupt the policy creation process. You can enable, disable, or change the Kaspersky Security Network mode for the managed devices in the policy settings at any time.

6. Click Next.

   The General tab of the new policy settings window opens.

7. On the General tab, you can configure the following policy settings:
   • Policy name.
   • Policy status:
     • Active. The policy that is currently applied to the device.

     If this option is selected, this policy becomes active on the device upon the next device synchronization with the Administration Server. This option is selected by default.

     • Inactive. The policy that is not currently applied to the device.

     If this option is selected, the policy becomes inactive but remains in the Policies folder. You can activate the inactive policy later.

     • Out-of-office. Policy that becomes active when the device leaves the corporate network.

     If this option is selected, the policy becomes active when the device leaves the organization network.

   • Policy settings inheritance:
     • Inherit settings from parent policy. If this option is enabled, the policy settings values are inherited from the upper-level group policy and, therefore, are locked. The check toggle button is switched on by default.
     • Enforce settings inheritance for child policies If this option is enabled, the settings values of the child policies are locked. The toggle button is switched off by default.

   For general information about the policy settings, refer to Kaspersky Security Center documentation.

8. On the Application settings tab you can modify the policy settings.
9. Click Save.

The created policy will be displayed in the list of policies. You can change the policy settings later. For general information about managing policies, refer to Kaspersky Security Center documentation.

Editing policy settings

To edit policy settings:

1. In the main window of the Web Console, select Devices → Policies and policy profiles.

   The list of policies opens.

2. Select the administration group to which the policy is applied. To do so, click the link in the Current path field in the upper part of the window and select an administration group in the window that opens.

   The list displays only the policies configured for the selected administration group.

3. Select the policy for which you want to modify the settings, and click the link with the policy name to open the policy properties window.
4. Edit the policy settings.
5. Click Save.

The policy is saved with the updated settings.

Changing policy status

To change the policy status:

1. In the main window of the Web Console, select the Devices → Policies and profiles tab.

   The list of policies opens.

2. In the list, select the policy for which you want to modify the status, and click the link with the policy name to open the policy properties window.
3. On the General tab, in the Policy status section, select the required status:
   • Active. The policy that is currently applied to the device.

   If this option is selected, this policy becomes active on the device upon the next device synchronization with the Administration Server. This option is selected by default.

   • Inactive. The policy that is not currently applied to the device.

   If this option is selected, the policy becomes inactive but remains in the Policies folder. You can activate the inactive policy later.

   • Out-of-office. Policy that becomes active when the device leaves the corporate network.

   If this option is selected, the policy becomes active when the device leaves the organization network.

4. Click Save.

The policy status is changed.

Actions with policies

To copy, move, export, or import a policy:

1. In the main window of the Web Console, select the Devices → Policies and profiles tab.

   The list of policies opens.

2. In the list of policies, check the box next to the name of the required policy and click the action button above the list of policies.

Deleting a policy

To delete a policy:

1. In the main window of the Web Console, select the Devices → Policies and profiles tab.

   The list of policies opens.

2. In the list of policies, select a check box next to the policy that you want to delete.

   You can select several policies to delete them simultaneously.

3. Click the Delete button above the list of policies.
4. Confirm the deletion.

Policy settings

You can use the policy to configure Kaspersky Embedded Systems Security settings for all client devices included in the administration group.

The set and default values of the policy settings may differ depending on the license type.

Application settings tab

On the Application settings tab, you can select a section containing the settings you want to configure.

Sections and subsections

Page top

File Threat Protection

File Threat Protection prevents infection of the file system on the user device. File Threat Protection starts automatically with the default settings upon Kaspersky Embedded Systems Security start. It resides in the device operating memory and scans all files that are opened, saved, and launched.

File Threat Protection settings

Page top

Scan scopes window

The table contains the scan scopes. The application will scan files and directories located in the paths specified in the table. By default, the table contains one scan scope that includes all directories of the local file system.

Scan scope settings

You can add, edit, delete, move up, and move down items in the table.

Kaspersky Embedded Systems Security scans objects in the specified scopes in the order they appear in the list of scopes. If necessary, place the subdirectory higher in the list than its parent directory, to configure security settings for a subdirectory that are different from the security settings of the parent directory.

Add scan scope window

In this window, you can add and configure scan scopes.

Scan scope settings

Page top

Scan exclusions

Scan exclusion is a set of conditions. When these conditions are met, Kaspersky Embedded Systems Security does not scan the objects for viruses and other malware. You can also exclude objects by masks and threat names, and configure exclusions for processes.

Settings of scan exclusions

Page top

Exclusion scopes window

This table contains scan exclusion scopes. The application does not scan files and directories located at the paths specified in the table. By default, the table is empty.

Exclusion scope settings

You can add, edit, and delete items in the table.

Add exclusion scope window

In this window, you can add and configure exclusion scopes.

Exclusion scope settings

Page top

Exclusions by mask window

You can configure the exclusion of objects from scans based on name mask. The application will not scan files whose names contain the specified mask. By default, the list of masks is empty.

You can add, edit, or delete masks.

Exclusions by threat name window

You can configure the exclusion of objects from scans based on threat name. The application will not block the specified threats. By default, the list of threat names is empty.

You can add, edit, and delete threat names.

Exclusions by process window

The table contains the exclusion scopes for exclusion by process The exclusion scope for exclusion by process lets you exclude from scans the activity of the indicated process and files modified by the indicated process. By default, the table includes two exclusion scopes that contain paths to the Network Agents. You can remove these exclusions, if necessary.

Exclusion scope settings for exclusion by process

You can add, edit, and delete items in the table.

Trusted process window

In this window, you can add and configure exclusion scopes for exclusion by process.

Exclusion scope settings

Page top

Firewall Management

The operating system firewall protects personal data that is stored on the user's device. The firewall blocks most threats to the operating system when the device is connected to the Internet or a LAN. Firewall Management detects all network connections by the user's device and provides a list of IP addresses, as well as an indication of the default network connection's status.

The Firewall Management component filters all network activity according to the network packet rules. Configuring network packet rules lets you specify the desired level of the device protection, from blocking Internet access for all applications to allowing unlimited access.

It is recommended to disable other operating system firewall management tools before enabling the Firewall Management component.

Firewall Management settings

Page top

Network packet rules window

The Network packet rules table contains network packet rules that the Firewall Management component uses for network activity monitoring. You can configure the settings described in the table below for network packet rules.

Network packet rules settings

By default, the table of network packet rules is empty.

You can add, edit, delete, move up, and move down network packet rules in the table.

Network packet rule window

In this window, you can configure the network packet rule.

Network packet rule settings

Page top

Available networks window

The Available networks table contains the networks controlled by the Firewall Management component. The table of available networks is empty by default.

Available networks settings

You can add, edit, and delete available networks.

Page top

Network connection window

In this window, you can configure the network connection that the Firewall Management component will monitor.

Network connection

Page top

Web Threat Protection

While the Web Threat Protection component is running, Kaspersky Embedded Systems Security scans inbound traffic and prevents downloads of malicious files from the Internet and also blocks phishing, adware, or other malicious websites.

The application scans HTTP, HTTPS, and FTP traffic. Also, the application scans websites and IP addresses. You can specify the network ports or network port ranges to be monitored

To monitor HTTPS traffic, enable encrypted connection scans. To monitor FTP traffic, select the Monitor all network ports check box.

Web Threat Protection settings

Page top

Web address window

In this window, you can add a web address or a web address mask to the list of trusted web addresses.

You can add only HTTP/HTTPS web addresses to the list of trusted web addresses. You can use masks to specify web addresses. Masks are not supported to specify IP addresses.

Network Threat Protection

While the Network Threat Protection component is running, the application scans inbound network traffic for activity that is typical for network attacks. Network Threat Protection is started by default when the application starts.

The application receives the numbers of the TCP ports from the current application databases and scans incoming traffic for these ports. Upon detecting an attempt of a network attack that targets your device, the application blocks network activity from the attacking device and logs an event about the detected network activity.

To scan network traffic, the Network Threat Protection task receives port numbers from the application databases and accepts connections via all these ports. During the network scan process, it may look like an open port on the device, even if no application on the system is listening to this port. It is recommended to close unused ports by means of a firewall.

Network Threat Protection settings

Page top

IP address window

In this window, you can add and edit IP addresses. Network attacks from these IP addresses will not be blocked by Kaspersky Embedded Systems Security.

IP addresses

Page top

Kaspersky Security Network

To increase the protection of devices and user data, Kaspersky Embedded Systems Security can use Kaspersky's cloud-based knowledge base Kaspersky Security Network (KSN) to check the reputation of files, Internet resources, and software. The use of Kaspersky Security Network data ensures a faster response to various threats, high protection component performance, and fewer false positives.

Kaspersky Embedded Systems Security supports the following infrastructure solutions to work with Kaspersky's reputation databases:

• Kaspersky Security Network (KSN) – A solution that receives information from Kaspersky and sends data about objects detected on user devices to Kaspersky for additional verification by Kaspersky analysts and to add to reputation and statistical databases.
• Kaspersky Private Security Network (KPSN) – A solution that allows users of devices with Kaspersky Embedded Systems Security installed to access the reputation databases of Kaspersky, as well as other statistical data, without sending data to Kaspersky from their devices. KPSN is designed for corporate clients who can't use Kaspersky Security Network, for example, for the following reasons:
  • No connection of local workplaces to the Internet
  • Legal prohibition or corporate security restrictions on sending any data outside the country or the organization's local network

After changing the Kaspersky Embedded Systems Security license, submit the details of the new key to the service provider in order to be able to use KPSN. Otherwise, data exchange with KPSN will be impossible due to an authentication error.

Use of Kaspersky Security Network is voluntary. Kaspersky Embedded Systems Security suggests using KSN during installation. You can start or stop using KSN at any time.

There are two options for using KSN:

• KSN with statistics sharing (extended KSN mode) – you can receive information from the Kaspersky knowledge base, while Kaspersky Embedded Systems Security automatically sends statistical information to KSN obtained during its operation. The application can also send to Kaspersky for additional scanning certain files (or parts of files) that intruders can use to harm the device or data.
• KSN without statistics sharing – you can receive information from the Kaspersky knowledge base, while Kaspersky Embedded Systems Security does not send anonymous statistics and data about the types and sources of threats.

You can start or stop using Kaspersky Security Network at any time. You can also select another Kaspersky Security Network usage option.

No personal data is collected, processed, or stored. Detailed information about the storage, and destruction, and/or submission to Kaspersky of statistical information generated during participation in KSN is available in the Kaspersky Security Network Statement and on Kaspersky's website.

You can read the text of the Kaspersky Security Network Statement in the Kaspersky Security Network Statement window, which can be opened by clicking the Kaspersky Security Network Statement link.

Kaspersky Security Network settings

Page top

Kaspersky Security Network Statement

In this window, you can read the text of the Kaspersky Security Network Statement and accept its terms and conditions.

Kaspersky Security Network settings

Page top

Anti-Cryptor

Anti-Cryptor allows you to protect your files in local directories with network access by SMB/NFS protocols from remote malicious encryption.

While the Anti-Cryptor component is running, Kaspersky Embedded Systems Security scans remote devices calls to access the files located in the shared network directories of the protected device. If the application considers a remote device actions on network file resources to be malicious encrypting, this device is added to a list of untrusted devices and loses access to the shared network directories. The application does not consider activity to be malicious encryption if it is detected in the directories excluded from the protection scope of the Anti-Cryptor component.

For the Anti-Cryptor component to operate correctly, at least one of the services (Samba or NFS) must be installed in the operating system. For the NFS service, the rpcbind package must be installed.

Anti-Cryptor operates correctly with the SMB1, SMB2, SMB3, NFS3, TCP/UDP, and IP/IPv6 protocols. Working with NFS2 and NFS4 protocols is not supported. It is recommended to configure your server settings so that the NFS2 and NFS4 protocols cannot be used to mount resources.

Anti-Cryptor does not block access to network file resources until the device activity is identified as malicious. So, at least one file will be encrypted before the application detects malicious activity.

Anti-Cryptor settings

Page top

Protection scopes window

The table contains protection scopes of the Anti-Cryptor component. The application will scan files and directories located in the paths specified in the table. By default, the table contains one scan scope that includes all directories of the local file system.

Protection scope settings

You can add, edit, delete, move up, and move down items in the table.

Kaspersky Embedded Systems Security protects objects in the specified scopes in the order they appear in the list of scopes. If necessary, place the subdirectory higher in the list than its parent directory, to configure security settings for a subdirectory that are different from the security settings of the parent directory.

Add scan scope window

In this window, you can add or configure protection scope for the Anti-Cryptor component.

Protection scope settings

Page top

Exclusion scopes window

This table contains scan exclusion scopes. The application does not scan files and directories located at the paths specified in the table. By default, the table is empty.

Exclusion scope settings

You can add, edit, and delete items in the table.

Add exclusion scope window

In this window, you can add and configure exclusion scopes.

Exclusion scope settings

Page top

Exclusions by mask window

You can configure the exclusion of objects from scans based on name mask. The application will not scan files whose names contain the specified mask. By default, the list of masks is empty.

You can add, edit, or delete masks.

System Integrity Monitoring

System Integrity Monitoring is designed to track the actions performed on files and directories in the monitoring scope specified in the component operation settings. You can use System Integrity Monitoring to track the file changes that may indicate a security breach on a protected device.

To use the component, a license that includes the corresponding function is required.

System Integrity Monitoring settings

Page top

Monitoring scopes window

The table contains monitoring scopes for the System Integrity Monitoring component. The application monitors files and directories located in the paths specified in the table. By default, the table contains the Kaspersky internal objects (/opt/kaspersky/kess/) monitoring scope.

Monitoring scope settings for System Integrity Monitoring

You can add, edit, delete, move up, and move down items in the table.

Kaspersky Embedded Systems Security scans objects in the specified scopes, in the order they appear in the list of scopes. If necessary, place the subdirectory higher in the list than its parent directory, to configure security settings for a subdirectory that are different from the security settings of the parent directory.

Page top

Add monitoring scope window

In this window, you can add and configure monitoring scope for the System Integrity Monitoring component.

Monitoring scope settings

Page top

Exclusion scopes window

The table contains monitoring exclusion scopes for the System Integrity Monitoring component. The application does not scan files and directories located at the paths specified in the table. By default, the table is empty.

Monitoring exclusion scope settings

You can add, edit, and delete items in the table.

Add exclusion scope window

In this window, you can add or configure the monitoring exclusion scope for the System Integrity Monitoring component.

Monitoring exclusion scope settings

Page top

Exclusions by mask window

You can configure the exclusion of objects from monitoring based on name masks. The application does not scan the files with the names containing the specified masks. By default, the list of masks is empty.

You can add, edit, or delete masks.

Application Сontrol

During execution of the Application Control task, Kaspersky Embedded Systems Security controls the launching of applications on user devices. This helps reduce the risk of device infection by restricting access to applications. Application launching is regulated by Application Control rules.

Application Control can operate in two modes:

• Denylist. In this mode Kaspersky Embedded Systems Security allows all users to launch any applications that are not specified in the Application Control rules. This is the default operation mode of the Application Control component.
• Allowlist. In this mode Kaspersky Embedded Systems Security prevents all users from launching any applications that are not specified in the Application Control rules.

For each Application Control operation mode, separate rules can be created and an action can be specified: apply rules or test rules. Kaspersky Embedded Systems Security performs this action when it detects an attempt to start an application.

The Application Control settings are described in the following table.

Application Control settings

Page top

Application Control rules window

The Application Control rules table has the tabs with the rules for each operation mode: Denylist (active) and Allowlist. Both tabs of the Application Control rules table are empty by default.

Application Control rules settings

You can add, modify and remove Application Control rules.

Page top

Application Control rule window

In this window, you can configure the settings for the Application Control rule.

Configuring an Application Control rule

Page top

Application Control categories window

In this window, you can add a new category or configure the category settings for an Application Control rule.

Kaspersky Embedded Systems Security does not support use of the KL categories of Kaspersky Security Center.

Application Control categories

Page top

Select user or group window

In this window, you can specify a local or domain user or user group for which you want to configure a rule.

Configuring an Application Control rule

Page top

Device Control

When the Device Control task is running, Kaspersky Embedded Systems Security manages user access to the devices that are installed on or connected to the client device (for example, hard drives, cameras, or Wi-Fi modules). This lets you protect the client device from infection when external devices are connected, and prevent data loss or leaks. Device Control manages user access to devices using the access rules.

When a device, access to which is denied by the Device Control task, connects to a client device, the application denies the users specified in the rule access to this device and displays a notification. During attempts to read and write on this device, the application silently blocks the users specified in the rule from reading/writing.

Device Control settings

Page top

Trusted devices window

The table contains a list of trusted devices. The table is empty by default.

Trusted device settings

You can add a device to the list of trusted devices by the device ID or by selecting the required device in the list of devices detected on the user device.

You can edit and delete trusted devices in the table.

Trusted device (Device ID) window

In this window, you can add a device to the list of trusted devices by its identifier.

Adding device by ID

Page top

Trusted device window (List of detected devices)

In this window you can add a device to the list of trusted devices by selecting it in the list of existing managed devices.

Information about existing devices is available only if an active policy exists and synchronization with the Network Agent has been completed (the synchronization interval is specified in the Network Agent policy properties; the default setting is 15 minutes). If you create a new policy and there are no other active ones, the list will be empty.

Adding device from list

Clicking the Filter button opens the window, where you can set up the filtering of displayed information about devices.

Device types window

In this window, you can configure access rules for various types of devices.

Access rules for device types

Page top

Device access rules window

In this window, you can configure access rules and schedules for the selected device type.

Device access rules and schedules

Page top

Device access rules window

In this window, you can configure the device access rule.

Device access rule

Page top

Select user or group window

In this window, you can specify a local or domain user or user group for which you want to configure an access rule.

Configuring an access rule

Page top

Schedules window

In this window, you can specify the schedule for the selected device access rule.

You can add, edit, and delete access schedule.

You cannot delete the Default schedule.

Page top

Schedule for access to devices window

In this window, you can configure the device access schedule. You can configure schedules only for hard drives, removable drives, floppy disks, and CD/DVD drives.

In the General settings->Application settings section, if the Block access to files during scans check box is cleared, then it is not possible to block access to devices using a device access schedule.

Schedule for access to devices

Page top

Connection buses window

In this window, you can configure access rules for connection buses.

Connection rules for buses

Page top

Behavior Detection

By default, the Behavior Detection component starts when Kaspersky Embedded Systems Security starts and monitors the malicious activity of the applications in the operating system. When malicious activity is detected, Kaspersky Embedded Systems Security can terminate the process of the application that performs malicious activity.

Behavior Detection component settings

Page top

Exclusions by process window

The table contains the exclusion scopes for exclusion by process The exclusion scope for exclusion by process lets you exclude the activity of the indicated process and files modified by the indicated process. By default, the table is empty.

Exclusion scope settings for exclusion by process

You can add, edit, and delete items in the table.

Adding a process exclusion scope window

In this window, you can add and configure exclusion scopes for exclusion by process.

Exclusion scope settings

Page top

Managing tasks

You can configure the ability to view and manage Kaspersky Embedded Systems Security tasks on managed devices.

Task management settings

Page top

Removable Drives Scan

When the Removable Drives Scan task is running, the application scans the removable device and its boot sectors for viruses and other malware. The following removable drives are scanned: CDs, DVDs, Blu-ray discs, flash drives (including USB modems), external hard drives, and floppy disks.

Removable drives scan task settings

Page top

Proxy server settings

You can configure proxy server settings if the users of the client devices use a proxy server to connect to the internet. Kaspersky Embedded Systems Security may use a proxy server to connect to Kaspersky servers, for example, when updating application databases and modules or when communicating with Kaspersky Security Network.

Proxy server settings

Page top

Application settings

You can configure the general settings of Kaspersky Embedded Systems Security.

General application settings

Page top

Excluding process memory from scan window

The list contains paths to processes whose memory Kaspersky Embedded Systems Security excludes from process memory scans. You can use masks to specify the path. By default, the list is empty.

You can add, edit, and delete items in the list.

Container scan settings

You can configure the settings for namespace and container scan by Kaspersky Embedded Systems Security.

Container scan settings

Page top

Network settings

You can configure the settings of encrypted connection scans. These settings are used by the Web Threat Protection component.

When the encrypted connection scan settings are changed, the application generates a Network settings changed event.

Network settings

Page top

Trusted certificates window

You can configure a list of certificates considered trusted by Kaspersky Embedded Systems Security. The list of trusted certificates is used when scanning encrypted connections.

The following information is displayed for each certificate:

• certificate subject
• serial number
• certificate issuer
• certificate start date
• certificate expiration date
• SHA-256 certificate thumbprint

By default, the certificate list is empty.

You can add and remove certificates.

Adding a trusted certificate window

In this window, you can add a certificate that will be trusted by Kaspersky Embedded Systems Security.

The Add certificate link opens the standard file selection window. Indicate the path to the file that contains the certificate, in DER or PEM format.

After the certificate file is selected, the window displays certificate information and the file path.

Trusted domains window

This list contains the domain names and domain name masks that will be excluded from encrypted connection scans.

Example: *example.com. For example, *example.com/* is incorrect because a domain address, not a web page, needs to be specified.

By default, the list is empty.

You can add, edit and remove domains from the list of trusted domains.

Network ports window

This table contains the network ports monitored by the application if the Monitor specified ports only option is selected in the Network settings window.

The table contains two columns:

• Port – monitored port.
• Description – description of the monitored port.

By default, the table displays a list of network ports that are usually used for the transmission of mail and network traffic. The list of network ports is included in the application package.

You can add, edit, and delete items in the table.

Global exclusions

The table contains mount points that will be excluded from the scan scope for the application components that use the file operation interceptor (File Threat Protection and Anti-Cryptor).

The Path column displays the paths to the excluded mount points. The table is empty by default.

You can add, edit, and delete items in the table.

Adding a mount point exclusion window

Mount point settings

Page top

Storage settings

The Storage is a list of backup copies of files that have been deleted or modified during the disinfection process. Backup copy is a file copy created at the first attempt to disinfect or delete this file. Backup copies of files are stored in a special format and do not pose a threat. By default, the Storage is located in the /var/opt/kaspersky/kess/common/objects-backup/ directory. Files in the Storage may contain personal data. Root privileges are required to access files in the Storage.

Storage settings

Page top

Managing tasks in the Web Console

You can create the following tasks for managing Kaspersky Embedded Systems Security using the Web Console:

• Local tasks that are configured for an individual device
• Group tasks that are configured for devices within administration groups
• Tasks for sets of devices that do not belong to administration groups

  The tasks for the sets of devices are performed only on the devices that are specified in the task settings. If new devices are added to the device selection for which the task is created, this task is not applied to the new devices. To apply the task to these computers, you must create a new task or edit the settings of the existing task.

You can create any number of local tasks, group tasks, and tasks for device sets.

The tasks are executed only if Kaspersky Embedded Systems Security is running on the devices.

You can perform the following actions with tasks:

• Create a task.
• Edit task settings.
• Manage the start and stop of a task.
• Export and import a task.
• Delete a task.

For general information about the tasks in the Web Console, refer to Kaspersky Security Center documentation.

Creating a new task

To create a task:

1. In the main window of Web Console, select Devices → Tasks.

   The list of tasks opens.

2. Click Add.

   The Task Wizard starts.

3. In the New task window, configure the task settings:
   1. In the Application drop-down list, select Kaspersky Embedded Systems Security 3.3 for Linux.
   2. In the Task type drop-down list, select the type of task that you want to create.
   3. In the Task name field, enter a brief description, for example, Update the application for Accounting.
   4. In the Select devices to which the task will be assigned section, select a method for specifying devices.
   5. Click Next.
4. In the Task scope window, select the devices and click Next.
5. Complete the wizard.

A new task will be displayed in the list of tasks. The task will have the default settings. To configure the task settings, go to the task properties window. To run a task, select the check box next to the task and click the Start button.

In the list of tasks, you can monitor the task execution results, which include the task status and the statistics for task performance on the devices. You can also create a selection of events to monitor the task execution (Monitoring and reports → Event selections). For details on event selection, refer to Kaspersky Security Center documentation.

Task execution results are also saved locally and in Kaspersky Security Center reports.

Editing task settings

To edit task settings:

1. In the main window of Web Console, select Devices → Tasks.

   The list of tasks opens.

2. In the list, select the task for which you want to modify the settings, and click the link with the task name to open the task properties window.
3. Edit the task settings.
4. Click Save.

The task is saved with the updated settings.

Actions on tasks

To start, pause, resume, stop, export, or import a task:

1. In the main window of Web Console, select Devices → Tasks.

   The list of tasks opens.

2. In the list of tasks, check the box next to the name of the required task and click the action button above the list of tasks.

Deleting a task

To delete the task:

1. In the main window of Web Console, select Devices → Tasks.

   The list of tasks opens.

2. In the list of tasks, select the check box next to the task that you want to delete.

   You can select several tasks to delete them simultaneously.

3. Click the Delete button above the list of tasks.
4. Confirm the deletion.

Task settings

The tasks are executed only if Kaspersky Embedded Systems Security is running on the devices.

The following types of tasks are provided for managing Kaspersky Embedded Systems Security by means of the Web Console:

• Add Key. During the task execution, the application adds a key, including a reserve one, to activate the application.
• Inventory. During the task execution, the application receives information about all executable files stored on the devices.
• Update. During the task execution, the application updates the databases in accordance with the configured update settings.
• Rollback. During the task execution, the application rolls back the last database update.
• Malware Scan. During the task execution, the application scans the device areas that are specified in the task settings for viruses and other malware.
• Critical Areas Scan. During the task execution, the application scans boot sectors, startup objects, process memory, and kernel memory.
• Container Scan. During the task execution, the application scans containers and images for viruses and other malware.
• System Integrity Check. During the task execution, the application determines changes of each object by comparing the current state of the monitored object to its original state, which was previously established as a baseline.

The set and default values of the task settings may differ depending on the application license type.

Add a key

Using the Add Key task, you can add a key to activate Kaspersky Embedded Systems Security.

Add Key task settings

Page top

Kaspersky Security Center key storage window

In this window, you can select keys added to Kaspersky Security Center key storage and add keys to Kaspersky Security Center key storage.

Settings in the Kaspersky Security Center key storage window

Page top

Inventory

The Inventory task provides information about all applications executable files stored on the client devices. Obtaining information about the applications installed on the devices can be useful, for example, for creating Application Control rules.

The Kaspersky Security Center database can store information about up to 150,000 processed files. When this number of records is reached, new files will not be processed. To resume the Inventory Scan task, delete the files registered in the Kaspersky Security Center database as a result of previous inventories, from the device where Kaspersky Embedded Systems Security is installed.

Page top

Scan settings section (Inventory)

Inventory task settings

Page top

Add scan scope window

In this window, you can add and configure scan scope for the Inventory task.

Inventory scope settings

Page top

Exclusion scopes section

In the Exclusion scopes section for the Inventory task, you can configure the scopes to be excluded from scans.

Exclusion scopes window

This table contains scan exclusion scopes. The application does not scan files and directories located at the paths specified in the table. By default, the table is empty.

Exclusion scope settings

You can add, edit, and delete items in the table.

Add exclusion scope window

In this window, you can add and configure scan exclusion scope for the Inventory task.

Exclusion scope settings

Page top

Update

Updating the databases and application modules of Kaspersky Embedded Systems Security ensures up-to-date protection on your device. New viruses and other types of malware appear worldwide on a daily basis. The application databases contain information about the threats and the ways to neutralize them. To detect threats quickly, you are urged to regularly update the application databases and modules.

Database update source section

An update source is a resource that contains updates for Kaspersky Embedded Systems Security databases and application modules. Update sources can be FTP, HTTP, or HTTPS servers (such as Kaspersky Security Center and Kaspersky update servers), as well as local or network directories mounted by the user.

Update source settings for the Update task

Page top

Settings section

In the Settings section, you can specify the response timeout and the application update download settings.

Update task settings

Page top

Rollback

After the application databases are updated for the first time, the rollback of the application databases to their previous versions becomes available.

Every time a user starts the update process, Kaspersky Embedded Systems Security creates a backup copy of the current application databases. This allows you to roll back the application databases to a previous version if needed.

Rolling back the last database update may be useful, for example, if the new application database version contains invalid signatures, which causes Kaspersky Embedded Systems Security to block safe applications.

The rollback task does not have any settings.

Malware Scan

Malware Scan is a one-time full or custom scan of files on the device performed by the application. The application can carry out multiple malware scanning tasks at the same time.

By default, the application creates one standard virus scan task — a full scan. The application scans all the objects located on the local drives of the device, as well as all mounted and shared objects that are accessed via the Samba and NFS protocols with the recommended security settings.

During a full disk scan, the processor is busy. It is recommended to run the full scan task when the business is idle.

Scan settings section (Malware Scan)

Malware Scan task settings

Page top

Add scan scope window

In this window, you can add and configure scan scopes.

Scan scope settings

Page top

Scan scope section (Malware Scan)

You can configure scan scope settings for the Malware Scan task. The application allows you to scan files, boot sectors, client device memory, and startup objects.

Malware Scan scope task settings

Page top

Scan scopes window

The table contains name masks of the devices, whose boot sectors the application must scan. By default, the table contains the /** device name mask (all devices).

You can add, edit, and delete items in the table.

Exclusion scopes section (Malware Scan)

In the Exclusion scope section, you can configure exclusion scopes as well as exclusions by mask and by the threat name for the Malware Scan task.

Critical Areas Scan

The Critical Areas Scan task allows you to scan files, boot sectors, startup objects, process memory, and kernel memory.

Scan settings section (Critical Areas Scan)

Critical Areas Scan task settings

Page top

Add scan scope window

In this window, you can add and configure scan scopes.

Scan scope settings

Page top

Scan scope section (Critical Areas Scan)

Scan scope settings for the Critical area scan task

Page top

Scan scopes window

The table contains name masks of the devices, whose boot sectors the application must scan. By default, the table contains the /** device name mask (all devices).

You can add, edit, and delete items in the table.

Exclusion scopes section (Critical Areas Scan)

In the Exclusion scope section, you can configure exclusion scopes as well as exclusions by mask and by the threat name for the Critical Areas Scan task.

Page top

Container Scan

When the Container Scan task is running, Kaspersky Embedded Systems Security scans containers and images for viruses and other malware. You can run multiple Container Scan tasks simultaneously.

Integration with Docker container management system, CRI-O framework, and Podman and runc utilities is supported.

To use the task, a license that includes the corresponding function is required.

Scan settings section (Container Scan)

Container scan task settings

Page top

Exclusion scopes section (Container Scan)

In the Exclusion scopes section, you can configure exclusions by mask and by threat name for the Container scan task.

System Integrity Check

While the System Integrity Check (ODFIM) task is running, each object change is determined by comparing the current state of the monitored objects with its original state, which was previously established as a baseline.

To use the task, a license that includes the corresponding function is required.

The system baseline is created during the first run of the ODFIM task on the device. You can create several ODFIM tasks. For each ODFIM task, a separate baseline is created. The task is performed only if the baseline corresponds to the monitoring scope. If the baseline does not match the monitoring scope, Kaspersky Embedded Systems Security generates a system integrity violation event.

The baseline is rebuilt after an ODFIM task has finished. You can rebuild a baseline for a task using the corresponding setting. Also, a baseline is rebuilt when the settings of a task change, for example, if a new monitoring scope is added. The baseline will be rebuilt during the next task run. You can delete a baseline by deleting the corresponding ODFIM task.

Scan settings section (System Integrity Check)

System Integrity Check task settings

Page top

Add scan scope window

In this window, you can add or configure the monitoring scope for the System Integrity Check task.

Monitoring scope settings

Page top

Exclusion scopes section

In the Exclusion scopes section for the System Integrity Check task, you can also configure exclusion scopes for the scan and exclusions by mask.

Exclusion scopes window

The table contains monitoring exclusion scopes for the System Integrity Check component. The application does not scan files and directories located at the paths specified in the table. By default, the table is empty.

Monitoring exclusion scope settings

You can add, edit, and delete items in the table.

Add exclusion scope window

In this window, you can add and configure the monitoring exclusion scope for the System Integrity Check task.

Monitoring exclusion scope settings

Page top

Exclusions by mask window

You can configure the exclusion of objects from monitoring based on name masks. The application does not scan the files with the names containing the specified masks. By default, the list of masks is empty.

You can add, edit, or delete masks.

Configuring remote diagnostics of client devices

You can use remote diagnostics to perform the following operations remotely on client devices:

• Enable or disable tracing.
• Change the trace level.
• Load a trace file.
• Downloading a remote application installation log.
• Download system event (syslog) logs.
• Starting, stopping, and restarting applications.

Remote diagnostics of a client device is performed using the Administration Server in the remote diagnostics window.

For more information about the remote diagnostics, refer to Kaspersky Security Center Web Console documentation.

To open the remote device diagnostics window for a device:

1. In the main window of the Web Console, select Devices → Managed devices.

   The list of managed devices opens.

2. In the list of managed devices, select the device for which you want to perform remote diagnostics, and click the link with the device name to open the device properties window.
3. On the Advanced tab, select the Remote diagnostics section.

In the device remote diagnostics window, you can view the remote installation log.

To view the remote installation log on a device, do as follows:

1. Open the remote device diagnostics window.
2. On the Event logs tab, under Trace files, click Remote installation logs.

   The Device trace event logs window opens.