21 February 2024

Today, Kaspersky announces the launch of its integrated software solution that includes the set of functions for event monitoring and management, Kaspersky Unified Monitoring and Analysis Platform (KUMA) to help businesses and organizations stay safe in cyberspace while embracing digitalization.

Malaysia aims to supercharge its digital economy, boosting its GDP contribution to 22.6% by 2025. This plan involves powering up all industries and local businesses to compete globally and unlock high-value opportunities.

Driven by the Southeast Asia (SEA) rapid digitalization movement, experts at Kaspersky predict the upcoming cybersecurity threat landscape in the region this year. According to report by Kaspersky, the dangers of phishing, scams, data breaches, and geopolitically-motivated cyberattacks are seen to continue targeting organizations and individuals from the region.

In 2023, Kaspersky revealed that it has blocked 22 million local infections.

In order to empower businesses and organizations to be one step ahead these developing challenges and needs, Kaspersky brings a native Security information and event management (SIEM) solution for security information and event management, Kaspersky Unified Monitoring and Analysis Platform (KUMA).

What is KUMA? Benefits KUMA brings to businesses and organization

Back in June 2023, Kaspersky experts have uncovered a mobile Advanced Persistent Threat (APT) campaign while monitoring the network traffic of its corporate Wi-Fi network using the KUMA. Upon further analysis, company researchers discovered the threat actor has been targeting iOS devices of dozens of company employees, distributing zero-click exploits via iMessage to run malware gaining complete control over the device and user data.

“When it comes to cybersecurity, even the most secure operating systems can be compromised. As APT actors are constantly evolving their tactics and searching for new weaknesses to exploit, businesses must prioritize security of their systems. This involves providing employees and technical teams with the latest tools to effectively recognize and defend against potential threats as well as timely remediation of incidents,” says Yeo Siang Tiong, General Manager for Southeast Asia at Kaspersky.

KUMA is a unified console for monitoring and analyzing information security incidents. The fundamental program includes the following components:

• One or moreCollectors that receive messages from event sources and parse, normalize, and, if required, filter and/or aggregate them.
• ACorrelator that analyzes normalized events received from Collectors, performs the necessary actions with active lists, and creates alerts in accordance with the correlation rules.
• TheCore that includes a graphical interface to monitor and manage the settings of system components.
• TheStorage, which contains normalized events and registered incidents.

Advantages of KUMA include:

• High performance: 300k+ EPS per KUMA instance
• Low system requirements: Virtual or physical environment and up to 10k EPS AiO on one virtual server
• Scalability: Flexible microservice architecture with HA support for each component
• Unified web console interface: Single fully multi-tenancy UI console for everything
• Out-of-the-box integration: With third-party products and Kaspersky solutions
• Low entry threshold: Does not require knowledge of special query languages or writing rules

Thanks to the integration with the Kaspersky CyberTrace platform, which processes reports from the National Coordination Center for Computer Incidents, the researcher can extract compromise indicators and use them to detect events in SIEM.

SIEM is a central element of most mature information security systems, hence, it must meet all relevant market requirements and take into account the changing landscape of cyber threats. KUMA expands the capabilities of analysts, allows businesses and organiztions to optimize the budget for cybersecurity, providing protection at the optimal level.

“Threat actors increasingly use diverse tactics to launch sophisticated targeted attacks. Therefore, it is essential to use a platform that can provide a centralized view of security events in quickly identifying and responding to potential threats such as the Security Information and Event Management System (SIEM). A SIEM is commonly used for compliance support with internal security policies and external regulatory requirements, said Victor Chu, Head of Systems Engineering for South East Asia at Kaspersky.

He explained that  Kaspersky Unified Monitoring and Analysis Platform (KUMA) empowers cybersecurity teams’ efficiency in detecting, investigating, and responding to complex cyber incidents with the approach of XDR (Extended Detection and Response) capabilities.

Organizations, of different sizes and maturity, can deploy KUMA to receive security events from various third party sources and security tools while correlating these events with contextual threat intelligence feeds to identify suspicious or anomalous activities thus providing timely notification of security incidents. By collecting security events from all security controls and correlating them in real time with advanced analytics, KUMA aggregates all the information needed for further incident investigation and response. Hence, using KUMA, helps organisations gain insights and intelligence by providing the visibility and context needed to understand you their security posture and risks.

More information about the platform, please visit: https://support.kaspersky.com/help/KUMA/1.5/en-US/217694.htm