disc encryption

[S_E_]

Hi,

tried to find out some information regarding disc encryption. Especially on CheckPoint appliances with e.g. R81.10.

It looks like that there is no encryption by default. Correct? 

Is there any recommendation / best practise?

Checkmate ChatGPT provides infos to  ATRG: Full Disk Encryption (FDE) which and then refers to:

For detailed instructions and best practices, you can refer to the https://community.checkpoint.com.

However, FDE seems to be for Client PC (win/mac) and not for GAiA

Thanks

Best Regards

[the_rock]

Thats my understanding as well. I never heard of disk encryption for actual appliances, only endpoint.

Best,

Andy

Maybe someone can confirm if Im mistaken though.

https://sc1.checkpoint.com/documents/R80.40/SmartEndpoint_OLH/EN/Topics-EPSG/FDE-CPEncryptionPolicy-...

[Tal_Paz-Fridman · Accepted solution]

Reposting an answer from one of my colleagues:

Check Point Gaia is a hardened OS and intended for access by qualified and trained administrators only using strong authentication methods. They should also be installed in physically secure locations that are accessible only to trusted and authorized employees (R82 adds 2FA in Gaia)

Additionally all Check Point management traffic is strongly secured by SIC, providing confidentiality, integrity and MUTUAL authentication to management protocols over the network.

Assuming that these mitigating controls have been followed, the likelihood of malicious tampering is all but eliminated. This makes technical controls, like disk encryption, risky as such technologies could make things like RMA, troubleshooting, etc. much more difficult and time-consuming.

[the_rock]

Thanks for that explanation Tal.

Andy

[S_E_]

---

@Tal_Paz-Fridman wrote:

Reposting an answer from one of my colleagues:

Check Point Gaia is a hardened OS and intended for access by qualified and trained administrators only using strong authentication methods.

..

Assuming that these mitigating controls have been followed, the likelihood of malicious tampering is all but eliminated. This makes technical controls, like disk encryption, risky as such technologies could make things like RMA, troubleshooting, etc. much more difficult and time-consuming.

---

Hi,

Bingo, that is exactly the point.

Even if you have a strong authentication (TACACS+; RADIUS,AD) to GAIA OS.

I assume that you still need some kind of an emergency user (if above methods fail; connectivity issue) or expert password,  GRUB password.

Doing now an RMA of a harddisk, config and password/hashes can be read. (Please correct me if I'm wrong)

RAID1, RAID6 does not help in this case

Regards

[Chris_Atkinson]

In the case of an RMA you could atleast in the past retain the disk and dispose of this securely.

https://sc1.checkpoint.com/uc/htmls/pricelist/HardDriveRMA.html

[S_E_]

Thanks for info.

Obviously not valid for 6xxx/7xxx/9xxx series even for Diamond Customers.

Note: Only the following appliances are applicable for the HDD Retention Service: Smart-1 series (Smart -1 225, 3050 & 3150), 5900 appliance, Connectra 9070 (only),12000 series, 13000 series, 15000 series, 21400 series, 21600 series, 21700 series, 21800 series, 23000 series, TE1000x, and TE2000x series, IAS, IP Appliances (where applicable).

Nevertheless, thanks for info/input

Regards

Thanks

[the_rock]

I would still double check with TAC.

[PhoneBoy]

We do not currently implement FDE or similar technology on Quantum appliances.
Your best bet is to work with your local Check Point office on an RFE and/or an approved procedure for handling RMAs on sealed disk units.