KASPERSKY SECURITY NETWORK (KSN) STATEMENT

Kaspersky Security Network Statement (hereinafter "Statement") relates to Kaspersky Embedded Systems Security for Windows (hereinafter "Software").

KSN Statement along with the End User License Agreement for Software, in particular in the Paragraph "Conditions regarding Data Processing" specifies the conditions, responsibilities, and procedures relating to the transmission and processing of the data, indicated in the KSN Statement. Please carefully read the terms of this Statement, as well as all documents referred to in this Statement, before accepting it.

All terms used in this Statement have the same meaning defined in the End User License Agreement (EULA) under the clause "Definitions".

When the End User activates the use of KSN, the End User is fully responsible for ensuring that the processing of personal data of Data Subjects is lawful, particularly, within the meaning of Article 6 (1) (a) to (1) (f) of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") if Data Subject is in the European Union, or applicable laws on confidential information, personal data, data protection, or similar thereto.

Data Protection and Processing
The Rightholder handles the data it receives from the End User under this Statement in accordance with the Rightholder's Privacy Policy published at: https://www.kaspersky.com/Products-and-Services-Privacy-Policy.

Purpose of Data Processing
To make it possible to increase the Software's speed of reaction to information and network security threats. It is achieved by:
- determining the reputation of scanned objects;
- identifying information security threats that are new and challenging to detect, and their sources;
- taking prompt measures to increase the protection of the data stored and processed by the End User with the Computer;
- reducing the likelihood of false positives;
- increasing the efficiency of Software components;
- investigating cases of infection of a user's computer;
- improving the performance of the Rightholder's products;
- receiving reference information about the number of objects with known reputation.

Processed Data
While the KSN is enabled, the Rightholder automatically receives and processes the following data:
- information on detection efficiency: ID of the triggered record in the Software's anti-virus databases; OS Service Pack version; OS build number; OS edition; OS update number; OS version; Software database record version; Software installation ID (PCID); Software update ID; Software verdict on the object being processed; checksum (MD5) of the object being processed; checksum (SHA256) of the object being processed; date and time of detecting software by System Watcher; detect characteristics; device ID; directory code; extended information about the OS edition; full version of the Software; name of the object being processed; number of the detected software in the System Watcher context; path to the object being processed; reason of detecting software by System Watcher; result of the module integrity check; size of the object being processed; type of the installed Software; type of the triggered Software anti-virus databases record; version of the Software's component;
- information on certificate status: Software installation ID (PCID); Software update ID; certificate issuer name; certificate owner name and settings; certificate serial number; checksum (MD5) of the object being processed; checksum (SHA256) of the object being processed; date and time of signing the object; device ID; full version of the Software; public key of the certificate; result of certificate verification; timestamp of the Software databases; type of the installed Software;
- information on web service requests: DNS address of the web service being accessed; IP address of the DNS server; Software installation ID (PCID); Software update ID; category of reason for blocking access to the web service; device ID; full version of the Software; reason for blocking access to the web service; server access duration; type of the installed Software;
- information on file processing: Software database record ID; Software installation ID (PCID); Software update ID; checksum (MD5) of the object being processed; checksum (SHA256) of the object being processed; debug detection indicator; device ID; full version of the Software; name of the detected malware or legitimate software that can be used to damage the user's device or data; timestamp of the Software databases; timestamp of the triggered record in the Software's anti-virus databases; type of the installed Software; type of the triggered Software anti-virus databases record;
- information on Software errors: OS Service Pack version; OS build number; OS edition; OS update number; OS version; Software activation date; Software component ID; Software installation ID (PCID); Software key expiration date and time; Software license ID; Software license key creation date and time; Software localization; Software module ID; Software update ID; accessed IPv4 address of the web service; address for the Software module loading; attribute data; certificate issuer name; date and time of downloading local original index file; date and time when statistics started being received; description of an object being processed as defined in the object properties; device ID; digital certificate numerical order in the chain of trust; digital certificate thumbprint of the scanned object and hashing algorithm; error code; error type; extended information about the OS edition; flag indicating the presence of a signed timestamp in the digital certificate; full version of the Software; memory stack of the Software process failure; name of subsystem in which the error occurred; name of task in which the error occurred; name of the module in which the failure probably occurred; name of the original index file downloaded during the last update; nested error occurred during the application operation; number of devices/accounts covered by the Software license; number of the string in the script where the error has occurred; process system ID (PID); release date and time of the Software's databases; result of certificate verification; serial number of the Software license key; size of the object being processed; source file path; text of the error message; type of Software license used; type of the installed Software; version of the Software's component; version of the statistics being sent; web address being processed;
- information on object evaluation: Software component ID; Software installation ID (PCID); Software update ID; checksum of the object being processed; checksum type for the object being processed; device ID; full version of the Software; type of the installed Software;
- information on network attacks: ID of the triggered record in the Software's anti-virus databases; IP address of the attacker; OS Service Pack version; OS build number; OS edition; OS update number; OS version; Software installation ID (PCID); Software update ID; debug detection indicator; detect location within the web traffic being processed; device ID; direction of a network connection; extended information about the OS edition; full version of the Software; local port that was attacked; name of the detected malware or legitimate software that can be used to damage the user's device or data; protocol ID; release date and time of the Software's databases; source of the web-traffic being processed: local host or remote host; timestamp of the triggered record in the Software's anti-virus databases; type of the installed Software; type of the triggered Software anti-virus databases record; version of the statistics being sent;
- information on file scanning: ID of the task in which detection was performed; ID of the triggered record in the Software's anti-virus databases; OS Service Pack version; OS build number; OS edition; OS update number; OS version; Software installation ID (PCID); Software update ID; Software verdict on the object being processed; attribute of an object being processed; checksum (MD5) of the object being processed; checksum (SHA256) of the object being processed; device ID; directory code; extended information about the OS edition; full version of the Software; name of the object being processed; object type code; path to the object being processed; release date and time of the Software's databases; size of the object being processed; attribute of an object being processed, that allowed to recall the false positive decision on the object; timestamp of the triggered record in the Software's anti-virus databases; type of the installed Software; type of the triggered Software anti-virus databases record; version of the statistics being sent;
- information on objects scanning: ID of the task in which detection was performed; ID of the triggered record in the Software's anti-virus databases; OS Service Pack version; OS build number; OS edition; OS update number; OS version; Software installation ID (PCID); Software update ID; Software verdict on the object being processed; checksum (MD5) of the object being processed; checksum (SHA256) of the object being processed; detect characteristics; device ID; directory code; extended information about the OS edition; flag indicating whether the object being processed is a PE file; full version of the Software; name of the object being processed; object type code; path to the object being processed; release date and time of the Software's databases; size of the object being processed; timestamp of the triggered record in the Software's anti-virus databases; type of the installed Software; type of the triggered Software anti-virus databases record; version of the statistics being sent; vulnerability ID; vulnerability danger class;
- information on interaction with KSN: ID of the KSN service accessed by the Software; Software installation ID (PCID); Software update ID; date and time when statistics started being received; date and time when statistics stopped being received; device ID; full version of the Software; number of KSN connections taken from the cache; number of new KSN connections; number of requests for which a response was found in the local request database; number of successful KSN connections; number of successful KSN transactions; number of unsuccessful KSN connections; number of unsuccessful KSN transactions; number of unsuccessful requests caused by KSN being disabled in the Software settings; number of unsuccessful requests to KSN caused by network problems; number of unsuccessful requests to KSN caused by routing errors; protocol used to exchange data with KSN; temporal distribution of cancelled requests to KSN; temporal distribution of requests to KSN that timed out; temporal distribution of successful KSN connections; temporal distribution of successful KSN transactions; temporal distribution of successful requests to KSN; temporal distribution of unsuccessful KSN connections; temporal distribution of unsuccessful KSN transactions; total number of requests to KSN; type of the installed Software;
- information on Software installation and activation: ID of the information model used to provide the Software license; ID of the licensed Software; Software ID derived from the license; Software activation date; Software component name; Software installation ID (PCID); Software installation type; Software license ID; Software localization; Software rebranding ID; Software update ID; delay of sending the statistics; device ID; flag indicating whether participation in KSN is enabled; flag indicating whether the Software is connected to Web-Portal; full version of the Software; identifier of the partner organization via which the Software license order was placed; information about Software updates; installation date and time for the Software; operating status of the Software component; serial number of the Software license key; type of the installed Software;
- information on real-time object scanning: ID of the triggered record in the Software's anti-virus databases; OS Service Pack version; OS build number; OS edition; OS update number; OS version; Software installation ID (PCID); Software update ID; Software verdict on the object being processed; checksum (MD5) of the object being processed; checksum (SHA256) of the object being processed; detect characteristics; device ID; directory code; extended information about the OS edition; flag indicating whether the object being processed is a PE file; full version of the Software; name of the object being processed; object type code; path to the object being processed; release date and time of the Software's databases; size of the object being processed; timestamp of the triggered record in the Software's anti-virus databases; type of the installed Software; type of the triggered Software anti-virus databases record; version of the statistics being sent;
- information on database update results: OS Service Pack version; OS build number; OS edition; OS error code; OS update number; OS version; Software installation ID (PCID); Software update ID; date and time of the BSOD or unexpected power off; device ID; extended information about the OS edition; full version of the OS kernel; full version of the Software; type of the installed Software; version of the Software's component;
- information on the version of the operating system installed on the computer: Device Guard (windows) enablement status; OS ID; OS Service Pack version; OS edition; operating system bit version; version of the operating system installed on the user's computer;
- information on Software installation: Software installation ID (PCID); Software update ID; device ID; full version of the Software; type of the installed Software;
- information on analyzed objects: DNS name for the owner of the logon session; DNS server response; ID of the account under which the controlled process was started; ID of the operation being performed by the Software; ID of the operation being performed on the third-party software; ID of the task in which detection was performed; ID of the triggered record in the Software's anti-virus databases; IP address; IP address of the DNS server; Kerberos session key characteristics; Kerberos ticket cache flags mask; Kerberos ticket flags mask; MAC address of the network attack source; OS versions; Software categorization base ID; Software database record ID; Software database record version; Software installation ID (PCID); Software name; Software update ID; Software vendor name; Software verdict on the object being processed; Software version; WMI event consumer; Windows services hosted in the process being processed; access rights for the object being processed; account name of the user that owns the logon session; account that requested the Kerberos ticket; binary mask of options of the DNS query; binary mask of the parameters for the object being processed; checksum (MD5) of the Kerberos ticket data; checksum (MD5) of the object being processed; checksum (SHA256) of the object being processed; checksum of the user name; command line arguments for the process; computer name on the network (domain name); cryptographic suite that was used for issued Kerberos ticket; data about the license for identifying a group of users of the company that purchased the license by the comment in the license properties; data of the internal log; date and time of the last modification of the object being processed; date and time when the Kerberos ticket expires; date and time when the Kerberos ticket was issued; debug detection indicator; detected file operations with the object being processed; device ID; direction of a network connection; directory code; error code; event date and time; external IP address; file attributes of an object being processed; file operation code; flag indicating whether the object being processed is a PE file; format of the object being processed; full path to parent process file used to launch the process; full version of the Software; data of the internal log, generated by the anti-virus Software module for an object being processed; header of the http request being processed; heuristically derived name of the email marketer - email message sender; http request method; information about the client that uses a network protocol (user agent); information on who signed the file being processed; integrity level for the object being processed; license identifier; local IP address; location where code was injected in process; logon session type; name of network protocol used in the detected network attack; name of the Kerberos Realm that client name belongs to; name of the Kerberos Realm that server name belongs to; name of the Windows registry key; name of the created WMI event consumer; name of the created/modified OS service; name of the detected malware or legitimate software that can be used to damage the user's device or data; name of the domain controller used to issue Kerberos ticket; name of the domain used to authenticate the owner of the logon session; name of the filter used by the WMI event consumer; name of the object being processed; name of the server used to authenticate the owner of the logon session; names of the packers that packed the object being processed; namespace name for the WMI event consumer; network interfaces list of the computer; parent process system ID (PID); path to the object being processed; performed commands IDs; port number; process system ID (PID); release date and time of the Software's databases; result of action with the object being processed; result of status check in KSN of an object being processed; security zone identifier extracted from the NTFS stream; size of the object being processed; source file path; start type of the Windows service; third-party software update ID; time of the first launch of the object being processed; type of DNS query; type of the Windows registry value; type of the installed Software; type of the triggered Software anti-virus databases record; type of user account under which the potentially malicious object was started; unique ID of the activity log for the object being processed; unique ID of the logon session; unique User ID in the Rightholder's systems; unique event ID; user account security identifier (SID); user name for the owner of the logon session; value of the Windows registry element; web address being processed; web address from which the file that matches the process was downloaded; zone index where the endpoint IP address belongs;
- information on antivirus database detections: ID of the triggered record in the Software's anti-virus databases; Software installation ID (PCID); Software update ID; device ID; full version of the Software; name of the detected malware or legitimate software that can be used to damage the user's device or data; timestamp of the triggered record in the Software's anti-virus databases; type of the installed Software; type of the triggered Software anti-virus databases record;
- information on data sent to KSN: ID of data package that is being sent to KSN; Software installation ID (PCID); Software update ID; device ID; encryption characteristics of data package that is being sent to KSN; full version of the Software; type of the installed Software;
- information on errors during Software updates: OS Service Pack version; OS build number; OS edition; OS update number; OS version; Software health status after update; Software installation ID (PCID); Software update ID; device ID; error code of the update task; extended information about the OS edition; full version of the Software; number of failed update installations for the updater component; number of update installation error for the updater component; type of the installed Software; update task type; version of the updater component;
- information on incompatible environment: OS version supported by software drivers; Software installation ID (PCID); Software update ID; additional information about CPU features; additional information about OS features; code integrity options; current operating mode of software drivers; device ID; full version of the OS kernel; full version of the Software; hypervisor support mode; information about problems with third-party software; type of the installed Software;
- information on file execution: ID of the account under which the controlled process was started; ID of the triggered record in the Software's anti-virus databases; Software installation ID (PCID); Software update ID; Software verdict on the object being processed; attributes of executable file being processed; checksum (MD5) of the object being processed; checksum (SHA256) of the object being processed; command line; date and time of creating an executable file being processed; date and time of linking the executable file; debug detection indicator; detect characteristics; device ID; directory code; entropy of the file being processed; flag indicating an application which runs automatically at startup; flag indicating whether the object being processed is a PE file; format of the object being processed; full version of the Software; information on who signed the file being processed; name of the detected malware or legitimate software that can be used to damage the user's device or data; name of the object being processed; names of the packers that packed the object being processed; notification type; path to the object being processed; result of certificate verification; result of status check in KSN of an object being processed; size of the object being processed; notification type, that triggered the statistic sending; timestamp of the Software databases; timestamp of the triggered record in the Software's anti-virus databases; type of the installed Software; type of the triggered Software anti-virus databases record; version of the statistics being sent;
- information on Software update results: Software installation ID (PCID); Software update ID; code of the error category; component name; device ID; error code; full version of the Software; timestamp of the component (local version); timestamp of the root index of available updates; timestamp of the root index of updates being downloaded; timestamp of the update component (updated version); type of the installed Software;
- information on the software update service: Software installation ID (PCID); Software update ID; accessed IPv4 address of the web service; average speed of interaction with the update source; device ID; full version of the Software; number of files downloaded in one session from the update source; total size of information downloaded during update; type of the installed Software; type of usage error of the software update web server;
- information on detection quality: Software installation ID (PCID); Software update ID; checksum (MD5) of the object being processed; checksum (SHA256) of the object being processed; device ID; directory code; full version of the Software; name of the object being processed; path to the object being processed; result of status check in KSN of an object being processed; size of the object being processed; technical specifications of the applied detection technologies; type of the installed Software;
- information on statistical signs of malware: 4-byte vector calculated over the first 4096 bytes of the section; 4-byte vector calculated over the last 4096 bytes of the section; Software installation ID (PCID); Software update ID; application image size; bit mask of the Data Directories section in the PE file; checksum (MD5) of the object being processed; checksum (SHA256) of the object being processed; device ID; emulation depth; emulator version; entropy calculated over the first 4096 bytes of the section; entropy calculated over the last 4096 bytes of the section; full version of the Software; number of sections in the PE file; numeric value frequency calculated over the first 4096 bytes of the section; numeric value frequency calculated over the last 4096 bytes of the section; overlay size in the PE file; properties and checksums of the parts of the execution file; real size of the executable file section; size of the object being processed; technical specifications of the applied detection technologies; type of executable file scan task that sends statistics; type of the installed Software; value of the characteristics attribute from the PE file header; value of the subsystem attribute from the PE file header; version of a certain compiler; version of the statistics being sent; virtual size of the executable file section; zero value frequency calculated over the first 4096 bytes of the section; zero value frequency calculated over the last 4096 bytes of the section;
- information on Software operation after the update: type of the installed Software; notification type, that triggered the statistic sending; device ID; duration since the installation of last update; information about system memory usage by the Software; number of software dumps since the Software was installed; number of software dumps since the time of the last update; number of system dumps (BSOD) since the Software was installed; number of system dumps (BSOD) since the time of the last update; timestamp of the Software databases; ID and version of the Software module that crashed; version of the Software's component; type of the installed Software; Software localization; Software component name; operating status of the Software component; OS version, OS build number, OS update number, OS edition, extended information about the OS edition; release date and time of the Software's databases; information about Software updates;
- Objects that can be exploited by intruders to harm the User's computer can be also sent to Kaspersky to be examined additionally: Software installation ID (PCID); Software update ID; full version of the Software; information about Software updates; release date and time of the Software's databases; text of the error message;
- Files or their parts; segments of random access memory; boot sectors of the operating system; application activity reports;
- Name; size; version of the file being sent; its description and checksums (MD5; SHA2-256; SHA1); file path; ID of the format; name of the publisher; name of the product to which the file belongs; names of and paths to files accessed by the process; names and values of registry keys accessed by the process; segments of random access memory; URL and IP addresses accessed by the process or from which the file that was run originated;
- Certificate validity start and end dates and times if the file being sent has a digital signature; date and time when the certificate was signed; name of the certificate publisher; information about the certificate holder; impression and public key of the certificate; algorithms used to calculate them; certificate serial number;
- Information about the date and time of creation and modification of the file; an attribute signifying whether or not the date and time of file signature is used in signature verification; the result of integrity verification of the file;
- The name of the account under which the process is running; the name of the computer on which it has been started; headers of process windows; ID of anti-virus databases; name of the threat detected per the Rightholder's classification; unique ID of the license; expiration date and type of license; version of the operating system (OS) and service packs installed on the computer; local time;
- Objects detected at malicious links.
Such objects may be temporarily stored on the User's computer until they are transmitted.
Also, in order to prevent false positives, the Rightholder may receive trusted executable and non-executable files or their parts.

- information about checking the reputation of a detected suspicious object: checksum type for the object being processed; Software installation ID (PCID); checksum of the object being processed; full version of the Software; Software verdict on the object being processed; source of the decision made for the object being processed; data of the internal log, generated by the anti-virus Software module for an object being processed; Software update ID; type of the installed Software; device ID; size of the object being processed; storage time for object being processed; protocol used to exchange data with KSN; ID of the account under which the controlled process was started; timestamp of the Software databases; boot sectors of the operating system; segments of random access memory; data packages of the web traffic being processed; checksum of the user device name (MD5, SHA2-256, SHA1); window ID for the application being processed; license identifier; license expiration date; type of license used; version of the operating system installed on the user's computer; date and time on the user's device; description of the classes and instances in the WMI storage; Software vendor name; format of the object being processed; parent application name; name of the object being processed; path to the object being processed; directory code; date and time of creating an object being processed; date and time of the last modification of the object being processed; date and time when the certificate was issued; date and time when the certificate expires; date and time of signing the object; certificate issuer name; certificate owner name and settings; digital certificate thumbprint of the scanned object and hashing algorithm; public key of the certificate; calculation algorithm of public key of the certificate; algorithm for calculating the digital certificate thumbprint; certificate serial number; full names of files that were accessed by the object being processed; name of the Windows registry key; value of the Windows registry element; web address being processed; IP address that was accessed by the object being processed; web address from which the file that matches the process was downloaded; IP address from which the file that matches the process was downloaded; command line; number of devices/accounts covered by the Software license; logon session key; encryption algorithm for the logon session key; ID of the key from the keystore used for encryption; fragment order in the object being processed; objects or its parts being processed; fragment content of the object being processed; file of the web page being processed; file of the email message being processed; checksum (MD5) of the object being processed; checksum (SHA256) of the object being processed; description of an object being processed as defined in the object properties; version of the object being processed; information about file signature check results;
- information on Script monitoring detections: checksum (SHA256) of the object being processed; timestamp of the triggered record in the Software's anti-virus databases; name of the object being processed; version of the statistics being sent; accessed IPv4 address of the web service; size of the object being processed; name of the detected malware or legitimate software that can be used to damage the user's device or data; release date and time of the Software's databases; checksum (MD5) of the object being processed; sequence number of the script detected on the web page by the application; web address of the source of the web service request (referer); accessed IPv6 address of the web service; OS version, OS build number, OS update number, OS edition, extended information about the OS edition; format of the object being processed; type of the triggered Software anti-virus databases record; debug detection indicator; web address being processed; ID of the triggered record in the Software's anti-virus databases; OS Service Pack version.
Also, in order to increase the effectiveness of protection provided by the Software, the Rightholder may receive objects that could be exploited by intruders to harm the Computer and create information security threats. Such objects include:
- executable and non-executable files or their parts;
- portions of the Computer's RAM;
- sectors involved in the process of booting the OS;
- network traffic data packets;
- web pages and emails containing suspicious and malicious objects;
- description of the classes and instances of classes of the WMI repository;
- application activity reports.
Such application activity reports contain the following data about files and processes:
- the name, size and version of the file being sent, its description and checksums (MD5, SHA2-256, SHA1), file format identifier, the name of the file's vendor, the product name to which the file belongs, full path on the Computer, template code of the file path, the creation and modification timestamps of the file;
- start and end date/time of the validity period of the certificate (if the file has a digital signature), the date and the time of the signature, the name of the issuer of the certificate, information about the certificate holder, the fingerprint, the certificate's public key and appropriate algorithms, and the certificate's serial number;
- the name of the account from which the process is running;
- checksums (MD5, SHA2-256, SHA1) of the name of the Computer on which the process is running;
- titles of the process windows;
- identifier for the anti-virus databases, name of the detected threat according to Rightholder's classification;
- data about the installed license, its identifier, type and expiration date;
- local time of the Computer at the moment of the provision of information;
- names and paths of the files that were accessed by the process;
- names of registry keys and their values that were accessed by the process;
- URL and IP addresses that were accessed by the process;
- URL and IP addresses from which the running file was downloaded.

Also, in order to prevent false positives, the Rightholder may receive trusted executable and non-executable files or their parts.

The description of the data transmitted depending on the KSN use settings specified can be found in the User Manual.

Your Choice to Participate
It is entirely Your choice to automatically send data to the Rightholder on a regular basis under this Statement. You can withdraw Your consent at any time in the settings of the Software as described in the User Manual.
When the End User decides to disable the KSN, the Rightholder will not receive new data. The Rightholder may still process certain data already received under legitimate interest according to point (f) of Article 6 (1) of the EU General Data Protection Regulation (GDPR) for the purposes described in the Privacy Policy at https://www.kaspersky.com/Products-and-Services-Privacy-Policy. If the End User wishes to object to such data processing, the End User must inform the Rightholder in the manner specified in the Privacy Policy. For more information about legal bases for data processing and End User's rights and options, the End User may consult the Privacy Policy at https://www.kaspersky.com/Products-and-Services-Privacy-Policy.

© 2023 AO Kaspersky Lab