An EPP and EDR that meets a very reasonable price.
Rating: 10 out of 10
January 19, 2024
Vetted Review
Verified User
2 years of experience
We use it as an antivirus and as an EDR to detect new risks that appear; it can detect ransomware, polymorphic malware, and some social engineering attacks. It is also capable of detecting compromised accounts. Additionally, we have it connected to our SIEM to obtain reports of viruses, malware, ransomware, and unauthorized access attempts.
- Antivirus
- Equipment and infrastructure protection system.
- A single console for everything.
Cons
- Improve installation on Mac OS.
- Sometimes the web console is slow.
- Does not have an agent for Linux.
90%
9.0
- Reduction of viruses on computers.
- Ransomware reduction.
- Easier management with the centralized console.
We were analyzing the characteristics and prices of the other software and the one that best suited our needs was this one. The final reason that made us decide on this product was that it is registered in the CCN-CERT ICT Security Guide as a High level in the ENS.
200
We use Kaspersky Endpoint Security as an antivirus and to control threats on user and server computers.In this way we avoid and control the possibility of having viruses in the company's computer park and identify possible threats that arrive by email or Internet browsing.This way we avoid the loss of information and reduce the time of unavailability of the services controlled by this antivirus.
3
We currently have 3 system administrators supervising the Kaspersky Endpoint Security Cloud console, in this way we try to cover the team's vacations and illnesses.Likewise, one of these technicians is dedicated to keeping the console updated, another to keeping the clients updated and another to review the computers with alerts or that have problems connecting to the console or updating the client, the tasks are rotated. among the technicians so that everyone knows how to do everything.
- Ransomware detection
- Virus detection
- Detection of abnormal behavior on computers and servers
- Detection of abnormal behavior on computers and servers
- To add new computers and servers
Yes
Kaspersky Endpoint Security Cloud replaced Sophos Intercept X Endpoint EDR software.The change in commercial product is due to the fact that Kaspersky Endpoint Security Cloud is certified in the National Security Scheme at High Level and the Sophos Intercept X Endpoint was certified in the National Security Scheme as a Medium Level.
- Cloud Solutions
- Ease of Use
- Other
Kaspersky Endpoint Security Cloud is certified in the National High Level Security Scheme. Another advantage that this software presents is that the console is located in the cloud, so it is always updated since it is maintained by Kaspersky and avoids having a local server dedicated to the console with the consequent savings in economic costs.
Our selection process is very simple, we are looking for a product that is certified in the National Security Scheme with High Level and that has a console with a short learning curve and that provides activity reports of the computers on which the antivirus clients are installed and that is a reliable product.
- Implemented in-house
Yes
The phases we followed in the implementation were:
* connect to the Kaspersky Endpoint Security cloud console and familiarize ourselves with its interface
* Provide visibility to the cloud console with the IT equipment on our network.
* install Kaspersky Endpoint Security Cloud clients on computers and connect them to the cloud console
* From the console review the clients and update the clients and their virus definition to the latest version.
* connect to the Kaspersky Endpoint Security cloud console and familiarize ourselves with its interface
* Provide visibility to the cloud console with the IT equipment on our network.
* install Kaspersky Endpoint Security Cloud clients on computers and connect them to the cloud console
* From the console review the clients and update the clients and their virus definition to the latest version.
- Access the cloud web console.
- Identify the ports that must be opened in the firewall to have visibility between the cloud web console and the servers.
- Connect Kaspersky Endpoint Security clients to the console.
- Online Training
- In-Person Training
- No Training
The Kaspersky Endpoint Security Cloud online training was very complete and access to the console and the main administration tasks were explained to us.Also how to view security events, customer inventories and reports.In addition, Kaspersky provides a large number of manuals, web help, and videos to refresh your knowledge in the future.
We do not have specific recommendations or "best practices" for configuring Kaspersky Endpoint Security Cloud, we have followed the instructions provided by Kaspersky on its website and in the product manuals.We have also followed the internal guidelines that we have set on security issues.Although the best recommendation is to follow common sense.
No - we have not done any customization to the interface
No - we have not done any custom code
We have not made any additional configuration or customization, we have only reviewed the virus definition update times on the clients, the file quarantine time and the email notifications.We have done this to keep the configurations homogeneous in terms of security.Although the best configuration is to follow common sense.
We contracted the "Standard Support" plan from Kaspersky Endpoint Security Cloud Premium support to be able to have the opportunity to open incidents. We hired "Standard Support" because having attention during standard office hours was enough.This way, if we have problems with the software, we can open incidents with Kaspersky support for a solution.
No
We have not had any large or "rare" incidents with the Kaspersky Endpoint Security Cloud product. We have had minor incidents that the Kaspersky Lab team resolved quickly and without any complications, as we reported them to them using their ticketing tool. Once they provided us with the corresponding instructions, the small problem we had was resolved.
- Access to the cloud web console from anywhere.
- Centralized view of all events and threats from the cloud console
- A lot of information is provided about the product and numerous training videos to properly handle the product.
- Know the different types of devices in Kaspersky Endpoint Security Cloud and the different policies that can be applied depending on the type of device selected.
- Using the “root cause analysis” feature is a bit complex and requires some security experience.
- To correctly use Endpoint Detection and Response (EDR) it is necessary to have some experience.
We have not integrated Kaspersky Endpoint Security Cloud with any products.
The main terms I negotiated with the vendor about the Kaspersky Endpoint Security Cloud product were the number of licenses we needed and the annual price. We also negotiated that it would be possible to increase licenses during the contract period and that all licenses, initial licenses and licenses that were extended, would end at the same time.
My advice, whether for this supplier or manufacturer, is to be as honest as possible to avoid confusion or misunderstandings and to use common sense in negotiations with the supplier.If your needs are clearly and concisely communicated to the provider, they will be able to prepare a plan appropriate to your needs.
Yes
The Kaspersky Endpoint Security Cloud product update went smoothly with no downtime. We also did not have any impact or incidence on the service.We carried out a distributed update plan and we updated the computers from the cloud console in a staggered manner, until the update was completed on all the computers we did not perform the update on the next group of computers.
- Fix minor product bugs
- Update reports
- Update on virus definition
- Fix minor product bugs
- Update reports
- Update on virus definition
No
No