Endpoint Security / SandBlast Agent Newsletter - Version E83.10

[Ami_Barayev1]

Hi all,

We are happy to announce the release of Endpoint Security Client E83.10

E83.10 introduce new functionalities and quality improvements.

The complete list of improvements can be found in the version release’s Secure Knowledge sk166979

URL Filtering – Early Availability

URL Filtering (URLF), provides organizations with ability to dynamically allow/block access to certain websites in real-time.

Assure safe internet access for users on/off the organization premises, comply with regulation compliance and Improve organization productivity.

URLF is completely refactored and is now simpler to use and managed:

• New Policy simplified using Super Categories for quick navigation and settings of URL categories
  • Security
  • Productivity loss
  • Legal Liability & Regulatory compliance
  • Bandwidth consumption
  • General use
• Supported via cloud management WebUI only
• URLF functionality is enabled using SandBlast Agent Browser Plugin, enabling:
  • Full visibility to all HTTP/HTTPS traffic
  • No need for complex/expensive SSL inspection
• Supported on Chrome for windows – Additional browser support and platforms will be available during H2-2020

URLF is supported on all SandBlast Agent packages with no additional fee.

Anti-Credential Theft – Pass-the-Hash attack Protection

E83.10 introduces enhancements to the credential theft protection suite which already supports Zero-day phishing, corporate password re-use and credential dumping.

Pass-the-Hash attack protection is a new supplement to Behavioral Guard which prevent an attacker to authenticate a system using stolen hashed credential which typically obtain using credential dumping techniques.

The new enhancement add another layer of protection against credential theft and improves the endpoint security posture.  

Virtual Desktop Infrastructure (VDI) Persistent and Non-Persistent for VMware Horizon – General Availability

Virtual desktop infrastructure (VDI) is virtualization technology that hosts a desktop operating system on a centralized server.

With persistent VDI each desktop runs from a separate disk image. The user's settings are saved and appear each time at login and allows more personalization experience.

Non-persistent VDI creates a generic desktop that always reverts to the same original setup after a user logs out. Additionally a non-persistent desktop does not allow a user to install an application and retain it across logons.

E83.10 supports VDI persistent and non-persistent modes as GA.  

More information is available at E83.10 VDI Administration Guide

Additional Enhancements

Threat prevention

• Behavioral Guard now protects against the "Pass The Hash" technique for credential theft. Credential Dumping is new, as of the previous release.
• Fixes an issue where Anti-Ransomware does not detect a potential attack when the user is not logged in.
• Fixes Anti-Ransomware false positives due to user profile deletions.
• Fixes multiple rare cases of false positives in Anti-Ransomware.
• Fixes an issue where "out of memory" errors occur when the log lists a very large number of backups.
• When you disable Anti-Ransomware, the backup driver no longer operates.
• Improves performance as Forensics now stores fewer named objects, such as mutexes and events.
• Improves the performance of Forensics, Behavioral Guard and Threat Hunting with enhancements to our Registry Operation exclusion algorithms that reduce the number of recorded registry operations.
• Resolves an issue where an Anti-Malware scheduled scan occurs, even if it is not in the policy.
• Resolves an Anti-Malware icon scaling issue.
• Resolves a possible issue where the Anti-Malware process crashes as it shuts down.

Data and Access Control

• Resolves client network issues after a Firewall driver uninstallation failure.
• Resolves a rare issue where an added Firewall blade gets stuck in the "Initializing" state.
• Resolves a possible upgrade issue where the Firewall blade does not start due to a WatchDog failure.
• Resolves a rare issue where the Firewall policy is "Not Set" in the client after the policy download from the server.
• Resolves a possible issue where the Disk Encryption process crashes during shutdown.
• Resolves a removable media icon blink issue for an encrypted partition when Media Scan is enabled.
• Improves the work with non-UTF-8 applications. Users can toggle UTF-8 support.
• Fixes active File Transfer Protocol (FTP) traffic blocks on a standalone VPN client with Firewall.
• Includes stability and quality fixes. Supports all the features of previous releases.

Installation & Infrastructure

• Resolves a possible issue where uninstalling the Endpoint removes components that are necessary for other applications.
• Resolves a possible issue where the uninstall fails after the user turns off "Network Protection".
• Resolves a possible issue where the Endpoint Security Client does not run correctly after an operating system upgrade.
• Resolves a rare issue where the client uninstall fails with Error 1921: "Service Check Point Endpoint Agent (CPDA) could not be stopped".
• Resolves a rare issue where an upgrade that uses "Dynamic Package" continuously loops after a download fails to resume.
• The pre-boot language selection choice is now correct after a language update in Windows.
• Fixes an incompatibility issue with Sophos Antivirus, which could not install on a machine with Endpoint Security Client on it.
• Resolves a rare User Interface (UI) issue where a malware resolution is not shown to a user.
• Resolves a client LogViewer issue, where it only shows log records that match the latest log schema.
• On the Endpoint Security Client screen, the Overview list now shows "Anti-Bot and URL Filtering" instead of "Anti-Bot".
• The client User Interface (UI) is no longer shown during manual upgrades.
• Resolves URL infections report issues in the User Interface (UI) so that the infections records are not permanent in the client and server UIs.
• Anti-Bot and URL Filtering policy now translates to all supported languages.
• Improves the performance of the Endpoint Security core driver to reduce CPU consumption.

Best

AmiB