CheckMates Fest 2021: Video and Q&A

[PhoneBoy]

The full CheckMates Fest 2021 video is available to CheckMates members.
Opening video is below.

Selected questions asked during the session are highlighted below.

Is the management server available on the cloud?

Yes, both for Endpoint Management and Network Security Management.

Does R81 include Mobile access policy in single console?

We’ve offered unified policy for MAB since R80.10. Legacy mode (and some settings) still requires SmartConsole in R81.

News about SourceGuard?

Its a formal part of our Shift Left approach and CloudGuard as enterprise management (where the UI elements are being added these days). In addition, it can be used as one-off from command line for developer consumption.

Is SSL decryption and inspection of inbound and or outbound connections going through the Firewall available?

This has been available for several versions already. A lot of improvements came out in the last few versions including TLS 1.3 support and Secure SNI handling (patented technology). Being on the latest release will ensure you can leverage all this functionality.

Is container security available in on-premise products? For example for the case of containers in local datacenter?

yes

Do you plan to implement VPN blade in SBA for Linux?

We are formally supporting the StrongSWAN client for Remote Access VPN with R81 gateways.

We support StrongSWAN for VPN for R81 gateways.

Will Sandblast Agent be submitted to independent testing eg NSSLabs, AvComparitives etc?

We participate in third party testing in general, yes, but not every third party test by every third party.

Is SandBlast Agent Web Extension for Edge in WORKGROUP mode (not domain joined) on the roadmap?

Planned for the near future.

Any update on ability to import third party IOC/threat feeds for endpoint?

We are working on this as part of our upcoming XDR offering, which is coming soon.

This interface on Sandblast Forensics offers support for integration with Service Now on incident management layer?

Technically you can do it today through the log exporter integration. You can export the forensics logs and then consume them in Service Now. We plan to do more native integration as part of the XDR offering.

Any plans for implementing Software-Defined Perimeter (SDP) ?

As it stands right now, we have a few security options for SDP/SASE. One of which, is Odo, which is being integrated as part of the CloudGuard Connect offering. See also CloudGuard Edge. 

Do we have roadmap for https redirect about captive portal?

This is supported with HTTPS Inspection enabled.

What URLs can we access to get any webinar from Check Point?

All CheckMates-related webinars are posted here on CheckMates. For other webinars, most of them will appear here:  https://www.checkpoint.com/webinars/ 

Can you compare XDR to EDR?

Think of SDR as an extension of EDR, covering not only endpoint but also FW, mail, mobile, cloud and more. On top of that, Threat Hunting, Incident analysis, Check Point intelligence and more.

What is the evergreen client?

Aclient which is always up to date, like your Chrome browser. It always updates itself to the last version automatically. We already doing it on Linux agent and browser agent. We are going to extend it to Windows and Mac.

On Predictive AI, is this based on historical data on customer or combined all data CP has? What type of datasets? Check Point only or external datasets as well? What is the learning timeframe for net new customers?

All Check Point protections leverage ThreatCloud, which is a mixture of the aforementioned. More details in the Threat Prevention Admin Guide .

Do we expect to see IoT Protect for SMBs? (visibility, Profiling/Modeling & enforcement)

The new IoT protect is built as a cloud solution and it will be available first for GAiA, but later also for SMB / Embedded GAiA.

Roadmap about mix and match on hyperscale, can we use different OS for different security group?

All should be Gaia, but you can mix different appliances

Question about SNX, is the still supported without java?

The deployment agent for SNX is still Java currently. SNX itself is a native component.

Do you have plans to release any WAF (Web Application Firewall)solution in the future base on OWASP top 10?

Very soon. this is what was mentioned as "application security" in the cloudguard roadmap 

Is URL filtering SBA included in R81 SmartEndpoint- ON Premise?

Yes, it is managed through the endpoint web management available on premise from R81. This will ultimately replace SmartEndpoint with a more convenient & modern management.

Is the upgrade from R80 to R81 seamless? Or is it as involved as R77 to R80?

You can upgrade from R80.20 and up to R81. The upgrade process received many improvements to make sure it's much better than the experience from R77.x. These include a detailed upgrade report and improved robustness. If you are on R80.10 or earlier, you'll need to do an upgrade first to R80.20 or up (preferably to R80.40).

Is there Covid Security in the roadmap?

In many ways, yes. Obviously, not in the physical aspects, but with the anti-phishing and other various network and endpoint protections we offer, including VPN, can help protect you from COVID-related attacks. (Such as false emails, etc.). Our CloudGuard Connect is a cloud service that is built to answer this need. Customers can connect their branch offices and remote users (either clientless or using the soon to be released CGC client application) and get secure access and threat prevention to both the Internet and to their internal corporate assets.

Importing upgrade_export configuration in R81, do it still need to be from empty/fresh install as in r80?

It is “migrate server” command now. If you are talking about migrating between two versions, you do have to use the target migration tool to export file, and then import it to a clearly installed server. From R80.20, you no longer need to manually download the target migration tool. The new mechanism is auto-updatable so as long as you're online, just run the command and specify the target version as the parameter.

Can Smart-1 Cloud logs can be integrated to local SIEM?

Yes. You can configure the Log Exporter functionality with Smart-1 Cloud and specify your SIEM as a target. A couple of tips:

1. Since we need to send the logs from the cloud to your local environment, you'll need to provide a public facing IP that we can send the logs to. This usually means static NAT or putting some forwarder in your DMZ.
2. Currently, you need to ask TAC to configure it for you. Very soon, we plan to open up the UI to configure it independently."

Can we do Management High Availability between smart-1 625 and NGSM25 for openserver?

Management High Availability isn't dependent on the hardware. Just make sure that both machines are powerful enough for your environment and have the required licenses to manage your gateways.

Question for SD-WAN, For R81.10 we will see any Load Balancing product included into Infinity Architecture???

Referencing to SDWAN more generally... we continue to value best of breed and partner but also we are adding internal SDWAN capabilities (we started with policy based routing but we will get more serious). Additional functionality will be added in later releases.

[Joe_O_Neill]

Will slides be provided. I would like to forward to management and they normally do not have time available to watch a webinar.

[PhoneBoy]

For roadmap sessions, we usually do not distribute slides.

[HeikoAnkenbrand]

     Congratulations to all the other winners
                                    and
all Checkmate users are winners in this community.