What Can Kaspersky Do Against Ransomware
Cryptors, ransomware, cryptomalware – these are the three different names for today’s cybersecurity scourge. Prevention and self-protection algorithms are well-known: “cold” backup, antiphishing tools, signature malware blocking, and sandboxing.
Cryptomalware can infiltrate and encrypt an entire network – including its backups – within minutes. In fact everything within the corporate network requires technical means to prevent ransomware from encrypting data, but file servers are the “weakest spot”, in the sense that if they are attacked by ransomware, businesses experience heavy interruption, down to termination of all processes.
How Ransomware Gets In
Most ransomware reaches a business through a phishing email, an exposed remote desktop port or an unpatched server. Once inside, it searches the network for file shares and backup targets. That is why the honest answer to What Can Kaspersky Do Against Ransomware is layered protection, not a single switch.
What Can Kaspersky Do Against Ransomware on File Servers
On file servers, Application Startup Control lets IT staff allow or block executables, scripts and installation packages. Behaviour analysis watches shared folders for encryption activity, and the malicious host blocker restricts access to shared network folders when a threat is detected. Kaspersky Endpoint Security covers the workstations where many infections start, so protection does not stop at the server.
Kaspersky Security for Windows Server
Kaspersky Lab has unveiled a new version of Kaspersky Security for Windows Server application, developed specifically for high performance corporate servers. It is enhanced with new Anti-Cryptor technology.
To help protect businesses from unknown and advanced threats, Kaspersky Security for Windows Server includes Application Startup Control: using configured rules IT staff can allow or block the startup of executable files, scripts, and installation packages, or the loading of program modules onto servers.
Then there is Anti-Cryptor technology based on Kaspersky Lab’s own algorithm: behaviour analysis is used here to detect and protect shared folders from encryption activity.
And if, for some reason, this encryption starts, there is a malicious host blocker: if any malicious activity is detected through Real-Time File Protection or Anti-Cryptor activities, access to shared network folders is immediately restricted to a secure server, protecting files from damage by any malicious third parties.
Kaspersky Security for Windows Server is available as a part of a Kaspersky Security for File Server, Kaspersky Endpoint Security for Business and Kaspersky Security for Storage.
What Else Your Business Needs
What Can Kaspersky Do Against Ransomware is a fair question, but the answer depends on the layers around it. Software alone will not stop every variant. Keep at least one backup copy offline or immutable, following the 3-2-1 rule: three copies, on two types of media, with one stored off-site. Limit user permissions so that one compromised account cannot reach every shared folder. Patch servers on a fixed schedule, enable multi-factor authentication for email and remote access, and train staff to report suspicious attachments.
Summary
What Can Kaspersky Do Against Ransomware? It can block unknown programs on servers, detect mass encryption in shared folders, restrict access to shared folders when an attack is detected, and protect workstations. It works best alongside tested backups, least-privilege access and regular patching.
Quick Checklist for Ransomware Defence
What Can Kaspersky Do Against Ransomware is only part of the answer. Start with the basics: confirm that backups are current and tested, restrict admin rights, and keep operating systems and applications patched. Then layer endpoint and server protection on top, so one missed patch or one clicked link does not stop your business.