topic Re: Air-gapped endpoints in environment using EpmaaS. in Endpoint

Air-gapped endpoints in environment using EpmaaS.

Alex- — Tue, 20 May 2025 11:09:58 GMT

One of our customers is using Infinity Harmony Endpoint for regular endpoints like computers, servers.

They have a requirement to deploy a few computers which would be in a completely isolated network and location for accessing and managing privileged information.

The framework requires a standalone EDR solution.

I've read Deploying Harmony Endpoint in an Offline (Air-Gapped) Environment which describes a completely offline installation of EPS server along with TE appliance.

As the customer is already using the online Endpoint, the question is whether we can leverage the existing option of creating a full standalone package, including signatures, installing locally and leave it offline, knowing the limitations of blades when offline, and update the signatures manually without access to any management server.

Re: Air-gapped endpoints in environment using EpmaaS.

G_W_Albrecht — Tue, 20 May 2025 11:36:10 GMT

Updating Signatures offline needs an On-Premise EPSS Management Server as documented in sk182535. So you can ask CP TAC if Infinity EPS could be used, but but signature update, using a TE appliance and its update will not be possible.

Re: Air-gapped endpoints in environment using EpmaaS.

lluner — Tue, 20 May 2025 12:52:24 GMT

@Alex-

You could use the supernode, the link is below. In addition, you could implement the endpoint firewall, only allowing access to the supernode.

Super-Node

Re: Air-gapped endpoints in environment using EpmaaS.

G_W_Albrecht — Tue, 20 May 2025 13:27:55 GMT

Also the supernode needs internet access, so it can not be used in a completely isolated network !

Re: Air-gapped endpoints in environment using EpmaaS.

lluner — Wed, 21 May 2025 11:20:36 GMT

tks

Re: Air-gapped endpoints in environment using EpmaaS.

Alex- — Tue, 20 May 2025 16:26:13 GMT

@lluner @G_W_Albrecht Thanks for chiming in.

This project has stringent requirements, so partial or derived Internet access like the super node is not compliant.

We will then explore if the air-gapped architecture with HEP can be considered.

Re: Air-gapped endpoints in environment using EpmaaS.

G_W_Albrecht — Wed, 21 May 2025 07:46:55 GMT

Please, do not adress me in a language i do not understand.

Re: Air-gapped endpoints in environment using EpmaaS.

Don_Paterson — Fri, 23 May 2025 19:40:24 GMT

You could ask you SE if Check Point will support a data diode. For example Owl.