topic Re: Host IPS in Endpoint

Host IPS

JoSec — Thu, 17 Sep 2020 15:06:59 GMT

Is adding Host IPS on the roadmap for endpoints? This would be beneficial as another layer to prevent an exploit of the system.

Re: Host IPS

PhoneBoy — Sun, 20 Sep 2020 21:41:27 GMT

I would say the entire SandBlast Agent suite functions as a host IPS.
What precise functionality do you perceive as missing?

Re: Host IPS

JoSec — Wed, 30 Sep 2020 17:43:52 GMT

The ability to provide prevention at the network layer prior to any code execution on the host itself.

Re: Host IPS

PhoneBoy — Mon, 05 Oct 2020 05:48:04 GMT

Not exactly sure how that would work since code would have to execute code on the host itself to process packets from the network.
A properly configured desktop firewall (which we do offer) can help limit what is processed by the host.
Also, if the traffic is encrypted, there's not much to process until the packets are decrypted, where our existing SandBlast Agent protections will help.

Re: Host IPS

IP2 — Wed, 26 Jan 2022 14:57:17 GMT

Would a standalone sandblast agent on a remote laptop outside the corporate network provide CVE specific IPS type protection?

For example, the Log4j IPS on the Security Gateway product:

https://www.checkpoint.com/defense/advisories/public/2021/CPAI-2021-0936.html

Re: Host IPS

Chris_Atkinson — Wed, 26 Jan 2022 22:56:00 GMT

Behavioural protection in prevent mode provides coverage here, stay tuned for some specific compliance enhancements in this regard.

Otherwise comparative like-to-like gateway protection for roaming users would be the Harmony Connect solution for a layered defense.