topic Re: Does Check Point have a response to the Solarwinds compromise as of yet? in General Topics

Does Check Point have a response to the Solarwinds compromise as of yet?

Paul_Warnagiris — Mon, 14 Dec 2020 12:11:31 GMT

https://www.cisa.gov/news/2020/12/13/cisa-issues-emergency-directive-mitigate-compromise-solarwinds-orion-network or https://isc.sans.edu/forums/diary/SolarWinds+Breach+Used+to+Infiltrate+Customer+Networks+Solarigate/26884/

Thanks,
Paul

Re: Does Check Point have a response to the Solarwinds compromise as of yet?

_Val_ — Mon, 14 Dec 2020 16:05:17 GMT

AFAIK, the all publicly available IOCs are inserted to the ThreatCloud. All Check Point customers with NGTX enabled can benefit from that already.

We are working on the official response, please stand by.

Re: Does Check Point have a response to the Solarwinds compromise as of yet?

schwilj — Mon, 14 Dec 2020 21:19:12 GMT

What about customers using Sandblast Advanced Endpoint Protection? Will then Anti-Bot, Anti-Ransomware, Threat Emulation blades or any other blades be able to detect the malicious dll files or other IOC?

Re: Does Check Point have a response to the Solarwinds compromise as of yet?

PhoneBoy — Mon, 14 Dec 2020 22:12:43 GMT

As of this moment, there is a protection in Anti-Virus for this, with Anti-Bot and Threat Emulation protections coming shortly.
SBA uses the same ThreatCloud as our gateway and can leverage the same protections.
Official response: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk171000&partition=Basic&product=Anti-Bot,