topic Re: disc encryption in General Topics

disc encryption

S_E_ — Thu, 22 Aug 2024 09:29:50 GMT

Hi,

tried to find out some information regarding disc encryption. Especially on CheckPoint appliances with e.g. R81.10.

It looks like that there is no encryption by default. Correct?

Is there any recommendation / best practise?

Checkmate ChatGPT provides infos to ATRG: Full Disk Encryption (FDE) which and then refers to:

For detailed instructions and best practices, you can refer to the https://community.checkpoint.com.

However, FDE seems to be for Client PC (win/mac) and not for GAiA

Thanks

Best Regards

Re: disc encryption

the_rock — Thu, 22 Aug 2024 12:26:33 GMT

Thats my understanding as well. I never heard of disk encryption for actual appliances, only endpoint.

Best,

Andy

Maybe someone can confirm if Im mistaken though.

https://sc1.checkpoint.com/documents/R80.40/SmartEndpoint_OLH/EN/Topics-EPSG/FDE-CPEncryptionPolicy-configuring.htm?TocPath=Full%20Disk%20Encryption%7CCheck%20Point%20Full%20Disk%20Encryption%7CConfiguring%20a%20Check%20Point%20Full%20Disk%20Encryption%20Policy%7C_____0

Re: disc encryption

Tal_Paz-Fridman — Thu, 22 Aug 2024 16:47:57 GMT

Reposting an answer from one of my colleagues:

Check Point Gaia is a hardened OS and intended for access by qualified and trained administrators only using strong authentication methods. They should also be installed in physically secure locations that are accessible only to trusted and authorized employees (R82 adds 2FA in Gaia)

Additionally all Check Point management traffic is strongly secured by SIC, providing confidentiality, integrity and MUTUAL authentication to management protocols over the network.

Assuming that these mitigating controls have been followed, the likelihood of malicious tampering is all but eliminated. This makes technical controls, like disk encryption, risky as such technologies could make things like RMA, troubleshooting, etc. much more difficult and time-consuming.

Re: disc encryption

the_rock — Thu, 22 Aug 2024 16:46:16 GMT

Thanks for that explanation Tal.

Andy

Re: disc encryption

S_E_ — Fri, 23 Aug 2024 08:57:13 GMT

@Tal_Paz-Fridman wrote:

Reposting an answer from one of my colleagues:

Check Point Gaia is a hardened OS and intended for access by qualified and trained administrators only using strong authentication methods.

..

Assuming that these mitigating controls have been followed, the likelihood of malicious tampering is all but eliminated. This makes technical controls, like disk encryption, risky as such technologies could make things like RMA, troubleshooting, etc. much more difficult and time-consuming.

Hi,

Bingo, that is exactly the point.

Even if you have a strong authentication (TACACS+; RADIUS,AD) to GAIA OS.

I assume that you still need some kind of an emergency user (if above methods fail; connectivity issue) or expert password, GRUB password.

Doing now an RMA of a harddisk, config and password/hashes can be read. (Please correct me if I'm wrong)

RAID1, RAID6 does not help in this case

Regards

Re: disc encryption

Chris_Atkinson — Fri, 23 Aug 2024 10:49:28 GMT

In the case of an RMA you could atleast in the past retain the disk and dispose of this securely.

https://sc1.checkpoint.com/uc/htmls/pricelist/HardDriveRMA.html

Re: disc encryption

S_E_ — Fri, 23 Aug 2024 10:57:03 GMT

Thanks for info.

Obviously not valid for 6xxx/7xxx/9xxx series even for Diamond Customers.

Note: Only the following appliances are applicable for the HDD Retention Service: Smart-1 series (Smart -1 225, 3050 & 3150), 5900 appliance, Connectra 9070 (only),12000 series, 13000 series, 15000 series, 21400 series, 21600 series, 21700 series, 21800 series, 23000 series, TE1000x, and TE2000x series, IAS, IP Appliances (where applicable).

Nevertheless, thanks for info/input

Regards

Thanks

Re: disc encryption

PhoneBoy — Fri, 23 Aug 2024 13:15:11 GMT

We do not currently implement FDE or similar technology on Quantum appliances.
Your best bet is to work with your local Check Point office on an RFE and/or an approved procedure for handling RMAs on sealed disk units.

Re: disc encryption

the_rock — Fri, 23 Aug 2024 13:15:41 GMT

I would still double check with TAC.