ECA – Endpoint Context Agent

Gathered via the operating system APIs Quick overview of eCA ECA collects the endpoint metadata and sends it to NGFWs NGFW Provides access control and/or/logging based on: Logged-in user Executable responsible for the flow Platform attributes Presence of ECA (i.e. not BYOD) Metadata Gathered via the operating system APIs Network Attributes Application Attributes User Platform Endpoint Context Agent Client Collects and sends the endpoint metadata to Forcepoint NGFW Hold TCP connections until permitted Able to send Metadata to 1-8 NGFWs Endpoint Context Agent Listener NGFW receives ECA metadata on TCP port 9111 in TLS socket (configurable) Enforce ECA access policy Log ECA information

Quick overview of what ECA is Replacement for McAfee EIA Agent for extra metadata for logging/reporting/access control and other policy features Unique competitive advantage Feature that is bundled with NGFW without extra cost Supports Windows 7, 8, 10, 2012, 2016 Uses secure TLS to transmit (potentially sensitive) metadata to NGFW NGFW authenticates ECA using custom certificate ECA authenticates NGFW using built-in StoneGate certificate ECA holds communication to ensure that NGFW processed metadata before getting actual traffic

Application attributes Executable binary name from the signed executable file SHA256 and MD5 checksums Product name Version Fingerprint of the signer certificate or public key Signature check result Signer name Platform attributes Local antivirus status BIOS serial number Endpoint load Full computer name Listening sockets, interfaces andports Local firewall status OS updates OS version User login/logout event User attributes Username (username@domain) User group information User ID User type

Major ECA customer use cases Reliable user identification Especially in thin client environment Many customers given up on their existing NGFW user identification… we can make a difference Firewall policy based on endpoint application For example, block outdated web browsers Firewall policy based on endpoint properties No recent windows updates = No internet access BYOD segregation Separate policy for BYOD even if they are on the same subnet TLS decryption bypass for thick clients Decryption bypass without whitelisting whole domain/service