Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
S_E_
Advisor
Jump to solution

disc encryption

Hi,

tried to find out some information regarding disc encryption. Especially on CheckPoint appliances with e.g. R81.10.

It looks like that there is no encryption by default. Correct? 

Is there any recommendation / best practise?

 

Checkmate ChatGPT provides infos to  ATRG: Full Disk Encryption (FDE) which and then refers to:

For detailed instructions and best practices, you can refer to the https://community.checkpoint.com.

 

However, FDE seems to be for Client PC (win/mac) and not for GAiA

 

Thanks

Best Regards

 

0 Kudos
1 Solution

Accepted Solutions
Tal_Paz-Fridman
Employee
Employee

Reposting an answer from one of my colleagues:

 

Check Point Gaia is a hardened OS and intended for access by qualified and trained administrators only using strong authentication methods. They should also be installed in physically secure locations that are accessible only to trusted and authorized employees (R82 adds 2FA in Gaia)

 

Additionally all Check Point management traffic is strongly secured by SIC, providing confidentiality, integrity and MUTUAL authentication to management protocols over the network.

 

Assuming that these mitigating controls have been followed, the likelihood of malicious tampering is all but eliminated. This makes technical controls, like disk encryption, risky as such technologies could make things like RMA, troubleshooting, etc. much more difficult and time-consuming.

View solution in original post

8 Replies
the_rock
Legend
Legend

Thats my understanding as well. I never heard of disk encryption for actual appliances, only endpoint.

Best,

Andy

Maybe someone can confirm if Im mistaken though.

https://sc1.checkpoint.com/documents/R80.40/SmartEndpoint_OLH/EN/Topics-EPSG/FDE-CPEncryptionPolicy-...

0 Kudos
Tal_Paz-Fridman
Employee
Employee

Reposting an answer from one of my colleagues:

 

Check Point Gaia is a hardened OS and intended for access by qualified and trained administrators only using strong authentication methods. They should also be installed in physically secure locations that are accessible only to trusted and authorized employees (R82 adds 2FA in Gaia)

 

Additionally all Check Point management traffic is strongly secured by SIC, providing confidentiality, integrity and MUTUAL authentication to management protocols over the network.

 

Assuming that these mitigating controls have been followed, the likelihood of malicious tampering is all but eliminated. This makes technical controls, like disk encryption, risky as such technologies could make things like RMA, troubleshooting, etc. much more difficult and time-consuming.

the_rock
Legend
Legend

Thanks for that explanation Tal.

Andy

0 Kudos
S_E_
Advisor

@Tal_Paz-Fridman wrote:

Reposting an answer from one of my colleagues:

 

Check Point Gaia is a hardened OS and intended for access by qualified and trained administrators only using strong authentication methods.

..

Assuming that these mitigating controls have been followed, the likelihood of malicious tampering is all but eliminated. This makes technical controls, like disk encryption, risky as such technologies could make things like RMA, troubleshooting, etc. much more difficult and time-consuming.


Hi,

Bingo, that is exactly the point.

Even if you have a strong authentication (TACACS+; RADIUS,AD) to GAIA OS.

I assume that you still need some kind of an emergency user (if above methods fail; connectivity issue) or expert password,  GRUB password.

Doing now an RMA of a harddisk, config and password/hashes can be read. (Please correct me if I'm wrong)

RAID1, RAID6 does not help in this case

Regards

 

0 Kudos
Chris_Atkinson
Employee Employee
Employee

In the case of an RMA you could atleast in the past retain the disk and dispose of this securely.

https://sc1.checkpoint.com/uc/htmls/pricelist/HardDriveRMA.html

CCSM R77/R80/ELITE
0 Kudos
S_E_
Advisor

Thanks for info.

 

Obviously not valid for 6xxx/7xxx/9xxx series even for Diamond Customers.

Note: Only the following appliances are applicable for the HDD Retention Service: Smart-1 series (Smart -1 225, 3050 & 3150), 5900 appliance, Connectra 9070 (only),12000 series, 13000 series, 15000 series, 21400 series, 21600 series, 21700 series, 21800 series, 23000 series, TE1000x, and TE2000x series, IAS, IP Appliances (where applicable).

 

Nevertheless, thanks for info/input

Regards

Thanks

the_rock
Legend
Legend

I would still double check with TAC.

0 Kudos
PhoneBoy
Admin
Admin

We do not currently implement FDE or similar technology on Quantum appliances.
Your best bet is to work with your local Check Point office on an RFE and/or an approved procedure for handling RMAs on sealed disk units. 

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events