access · management security · performance Wick Hill Ltd Value Added Distribution Check Point End Point

access · management security · performance Agenda Introductions Part 1 : History - End Point Story Part 2 : Present – The products right now Part 3 : Future – Roadmap Lunch Go Karting

access · management security · performance HISTORY

access · management security · performance Brief Product History 199X – VPN Clients SecuRemote SecureClient 2003 – ZoneAlarm Purchase Integrity Integrity Secure Client Integrity Clientless Security 2006 – Pointsec Purchase Pointsec for PC Pointsec Mobile Pointsec Protector

access · management security · performance Historic Licensing SecuRemote SecureClient Integrity Integrity Desktop Integrity Server Integrity Secure Client Integrity Clientless Security Pointsec for PC Pointsec Protector Reflex Magnetics DiskNet Pro Pointsec for MAC Pointsec Mobile SecureClient Mobile SSL Network Extender (SNX)

access · management security · performance Confusing Licensing Models Bundles of users / Individual Need for Server / No server Concurrent / Per User

access · management security · performance Licensing Simplication SecuRemote SecureClient Integrity Integrity Desktop Integrity Server Integrity Secure Client Integrity Clientless Security Pointsec for PC Pointsec Protector Reflex Magnetics DiskNet Pro Pointsec for MAC Pointsec Mobile SecureClient Mobile SSL Network Extender (SNX)

access · management security · performance Licensing Simplication SecuRemote – Now included in GW’s / Appliances SecureClient – EPSA Integrity – EPSA Integrity Desktop – EPSA Integrity Server – EPSA Integrity Secure Client – EPSA Integrity Clientless Security - Connectra Pointsec for PC – EP FDE Pointsec Protector – EP MEPP Reflex Magnetics DiskNet Pro – EP MEPP Pointsec for MAC Pointsec Mobile SecureClient Mobile Integrity Clientless Security SSL Network Extender (SNX)

access · management security · performance New Product Line Up EndPoint Security Secure Access EndPoint Security Full Disk Encryption EndPoint Security Media Encryption EndPoint Security Total Security SecureClient Mobile SSL Network Extender (SNX) Pointsec for MAC

access · management security · performance Pricelist.CheckPoint.Com

access · management security · performance Pointsec Mobile

access · management security · performance Secure Access / SNX

access · management security · performance Wickhill Can Help!!!! End Point Pricing Calculator

access · management security · performance End Point Secure Access Product Features Client Firewall Program Control Anti – Virus Anti – Spyware Network Access Control IPSEC VPN Enforcement Client IPS

access · management security · performance End Point FDE / MEPP Product Features Full Disk Encryption Client Device Control Media Encryption

access · management security · performance Product Installation / Managment End Point Secure Access Server / Client Server Integrated with SmartCentre End Point Media Encryption Server / Client End Point Full Disk Encryption Client / UNC Path for Central Managment

access · management security · performance Product Walkthrough DEMO

access · management security · performance PRESENT

access · management security · performance End Point Secure Access Policy Enforcement Options Userbased Policies LDAP RADIUS NTLM IP Based Policies Ranges Subnets Co-Operative Enforcement with Interspect Cisco VPN3000 Concentrator Nortel Contivity VPN CheckPoint VPN-1 Gateway 802.1x

access · management security · performance 802.1x IEEE 802.1X / IETF Standards Track (RFC 2284) Improve PPP authentication process Address security gaps in WiFi/WLAN deployments

access · management security · performance Standard EAP Session Enterprise Network SupplicantAccess Point RADIUS Server EAP Start EAP Request/ID Start EAP Authentication Ask Client for Identity EAP Response/ID (UserID) RADIUS Access Request Access Request w/ UserID EAP Request/ Challenge Perform EAP Sequence (MD5, TLS, PEAP) RADIUS Access: Accept EAP Success RADIUS Access Challenge: EAP RADIUS Reply/ Challenge EAP Response/ Password RADIUS Access: Restrict EAP Success ( restricted access) OR,

access · management security · performance Check Point EAP Integration Enterprise Network SupplicantAccess Point RADIUS Server Integrity Server RADIUS “Proxy” RADIUS Access: Accept EAP Success Accept Proxy (success) Proxy (failure) RADIUS Access: Restrict EAP Success ( restricted access) OR, RADIUS Request EAP Request/ Challenge: ZLX RADIUS Access Challenge: EAP ZLX RADIUS Reply/ Challenge EAP Response/ ZLX (policy) Policy Query Policy Lookup Reject (Std. EAP Session) = New components or data extensions = EAP existing standard

access · management security · performance NAC is Here to Enforce identity-based access policies Control who is accessing what Prevent guests from unauthorized access Allow demonstrable compliance with growing body of regulatory requirements Mitigate the risks of endpoint-borne attacks Check endpoint compliance as a precondition for network access Quarantine and remediate non-compliant endpoints Monitor devices connected on the network Protect against attacks on critical resources

access · management security · performance Flat networks are gone. Networks are becoming functionally segmented Access controls are being deployed between segments NAC brings identity and compliance awareness into segmentation and access control Internal Access Network Internal Applications DMZ Employee Partner Wireless Finance Sales Partner Employee Internet Context: NAC and “The disappearing perimeter”

access · management security · performance NAC has been over-hyped! Now we’re in the “trough of disillusionment” The rate of pilot-to-production is very low (and these pilots don’t come cheap!) The initial promise of “clientless NAC” is proving to be a mirage Standards are slow to take hold In the meantime Cisco – NAC’s largest promoter - markets the “Self Defending Network” but sells only proprietary, 802.1x-incompatible, SW-based “NAC appliance” Network Access Confusion

access · management security · performance Simplifying NAC Get your feet wet with limited NAC deployments Define a reasonable life span for your pending NAC projects Define Attainable security objectives Leverage existing investments Prediction: NAC is young. You won’t see a one-size-fit-all solution in 2008

access · management security · performance Check Point NAC Identify aware firewall in VPN-1Identify aware firewall in VPN-1 SecureClient SCV (desktop configuration verification)SecureClient SCV (desktop configuration verification) Integrity Client Network Access Control (Client Self-Enforcement)Integrity Client Network Access Control (Client Self-Enforcement) Integrity & VPN Gateway Access Control Integration (CP Endpoint Security and Cisco VPN Gateways)Integrity & VPN Gateway Access Control Integration (CP Endpoint Security and Cisco VPN Gateways) Integrity/802.1x LAN Access Control IntegrationIntegrity/802.1x LAN Access Control Integration Founding Member of Trusted Network Connect (TNC) InitiativeFounding Member of Trusted Network Connect (TNC) Initiative Clientless Security for Enforcement of Unmanaged PCsClientless Security for Enforcement of Unmanaged PCs Cooperative Enforcement with ConnectraCooperative Enforcement with Connectra Secure Automated RemediationSecure Automated Remediation Cooperative Enforcement with VPN-1 Edge (802.1x)Cooperative Enforcement with VPN-1 Edge (802.1x) Unified Management of NAC, Endpoint, and Network Security InfrastructureUnified Management of NAC, Endpoint, and Network Security Infrastructure Enforcement with Intel AMTEnforcement with Intel AMT CP EPS with VPN-1 UTM/PowerCP EPS with VPN-1 UTM/Power Identify aware firewall in VPN-1Identify aware firewall in VPN-1 SecureClient SCV (desktop configuration verification)SecureClient SCV (desktop configuration verification) Integrity Client Network Access Control (Client Self-Enforcement)Integrity Client Network Access Control (Client Self-Enforcement) Integrity & VPN Gateway Access Control Integration (CP Endpoint Security and Cisco VPN Gateways)Integrity & VPN Gateway Access Control Integration (CP Endpoint Security and Cisco VPN Gateways) Integrity/802.1x LAN Access Control IntegrationIntegrity/802.1x LAN Access Control Integration Founding Member of Trusted Network Connect (TNC) InitiativeFounding Member of Trusted Network Connect (TNC) Initiative Clientless Security for Enforcement of Unmanaged PCsClientless Security for Enforcement of Unmanaged PCs Cooperative Enforcement with ConnectraCooperative Enforcement with Connectra Secure Automated RemediationSecure Automated Remediation Cooperative Enforcement with VPN-1 Edge (802.1x)Cooperative Enforcement with VPN-1 Edge (802.1x) Unified Management of NAC, Endpoint, and Network Security InfrastructureUnified Management of NAC, Endpoint, and Network Security Infrastructure Enforcement with Intel AMTEnforcement with Intel AMT CP EPS with VPN-1 UTM/PowerCP EPS with VPN-1 UTM/Power Leveraging Existing Investment x

access · management security · performance Ensuring Endpoint Policy Compliance Auto-Remediation Policy checks for critical updates Internal and external NAC Ensures only safe endpoint devices can access the network Protects networks and systems from endpoint-borne attacks Facilitates remediation for out-of-compliance endpoints Network Access Control

access · management security · performance You can do it today with Endpoint Security Secure Employee Access with: Endpoint Security Self-Enforcement 802.1x support for VLAN steering Cooperative Enforcement for VPN-1 and UTM-1 All transparent to users!   Use Connectra portal for Guest/Partner access – –Endpoint Security On-Demand (ICS) provides posture checking – –For partners seeking access to internal applications, Check Point Secure Workspace provides a sanitized virtual platform the organization can trust – –Use SNX to deliver applications to partners, when needed

access · management security · performance Gateway (Firewall) Enforcement Corporate Network Internet HR Database Finance Database R65 Firewall Perimeter Firewall LDAP Directory Web Server Pool EPS 7 Server 1. Client Initiates connection to HR Resource 2. Gateway asks EPS server if endpoint is known and in compliance 3. EPS 7.0 Server checks for policy for AD\jsmith 4. Gateway implements compliant user firewall rules 5. User has access to HR database but can not even ping Finance servers (invisible to end user) No need to do printer exceptions No need to do VoIP phone exceptions Unique

access · management security · performance NAC Demo