The tenant protection infrastructure created using the Integration Server REST API is based on the usage of Kaspersky Security Center virtual Administration Servers. Each tenant is provided with a virtual Administration Server and an account to be used by the tenant administrator to connect to the virtual Administration Server.
One Kaspersky Security Center Administration Server can support up to 500 virtual Administration Servers.
Tenant virtual machines with Light Agents installed are located on the tenant virtual Administration Server.
Tenant administrators can perform the following actions on their virtual Administration Server:
For more information about virtual Administration Servers, see the Kaspersky Security Center help.
The provider's administrator installs the application in their infrastructure and ensures the operation of Light Agents and other application components:
The provider's administrator can also configure general protection settings of the tenant virtual machines.
During operation, information that may contain personal and confidential data is transmitted between Kaspersky Security Center and Kaspersky Security components installed in the provider's infrastructure and on the tenant virtual machines.
Before creating a tenant protection infrastructure, perform the following steps:
The following components must be installed in the provider's infrastructure:
If you want to use the web interface to interact with Kaspersky Security Center, you also need to install web plug-ins using the Web Console.
Tenant protection infrastructure deployment consists of the following steps:
It is recommended that the tenant administrator changes the account password received from the provider administrator.
The steps of the tenant protection infrastructure deployment can be automated using the Integration Server REST API and Kaspersky Security Center OpenAPI™.
To prevent unauthorized access, it is recommended to deploy the SVM and the device on which the Kaspersky Security Center Administration Server and the Integration Server are installed in a dedicated virtual network and to configure routing with address translation (SNAT) from the tenant subnets to this subnet.