47 slides from Check Point Software Technologies's technical presentation, Jul 31, 2024
Slide 1: Harmony Endpoint Onboarding Best Practice
Harmony Endpoint Onboarding Best Practice Yehonatan Cohen | Harmony POC Expert ©2024 Check Point Software Technologies Ltd. 1
Slide 2: Agenda
Agenda Approach (10 mins) Milestones (40 mins) Introduction Plan the Onboarding Order of Devices Set Up the Management Order of Capabilities Prepare the Pilot Group Steps per Capability Deploy ©2024 Check Point Software Technologies Ltd. 2
Slide 3: Approach
Approach ©2024 Check Point Software Technologies Ltd. 3
Slide 4: Agenda
Agenda Approach (10 mins) Milestones (40 mins) Introduction Plan the Onboarding Order of Devices Set Up the Management Order of Capabilities Prepare the Pilot Group Steps per Capability Deploy ©2024 Check Point Software Technologies Ltd. 4
Slide 5: Blocks all entry points 360
Blocks all entry points 360 Incident Management Monitoring & Incident Handling Research Intelligence XDR & MDR Deployment & Policy Handling Threat Hunting Remote Access VPN Forensic Report Access Firewall MITRE Mapping EDR Control Application Control Endpoint Compliance Threat Cloud Threat Sandboxin
Slide 6: Planning is key
Planning is key Break the deployment tasks into small systematic steps ©2024 Check Point Software Technologies Ltd. 7 7
Slide 7: Designated Groups of Devices
Designated Groups of Devices Pilot Group Entire Group Staging Production Different devices have different behaviors ©2024 Check Point Software Technologies Ltd. 8
Slide 8: Deployment Order Of Capabilities
Deployment Order Of Capabilities 1. Anti Malware 2. Anti-Bot, Behavioral Guard, and Forensics 3. Media Encryption & Port protection, FW & App Control 4. Full Disk Encryption, Remote Access VPN, Compliance ©2024 Check Point Software Technologies Ltd. 9
Slide 9: Steps per Capability
Steps per Capability Install Stabilize Review logs and create exclusions Analyze - Detect Analyze - Prevent Set on detect and Set on prevent and wait for 1-2 days wait for 1-2 days * Anti-malware is the only engine starting from prevent mode. ©2024 Check Point Software Technologies Ltd. 10
Slide 10: Agenda
Agenda ✔ Approach (10 mins) Milestones (40 mins) ✔ Introduction Plan the Onboarding ✔ Order of Devices Set Up the Management ✔ Order of Capabilities Prepare the Pilot Group ✔ Steps per Capability Deploy ©2024 Check Point Software Technologies Ltd. 11
Slide 11: Milestones
Milestones ©2024 Check Point Software Technologies Ltd. 12
Slide 12: Agenda
Agenda ✔ Approach (10 mins) Milestones (40 mins) ✔ Introduction Plan the Onboarding ✔ Order of Devices Set Up the Management ✔ Order of Capabilities Prepare the Pilot Group ✔ Steps per Capability Deploy ©2024 Check Point Software Technologies Ltd. 13
Slide 13: Kick-Off Meeting
Kick-Off Meeting Understand the unique preferences and needs of the environment. • Define the objectives • Plan the onboarding accordingly ©2024 Check Point Software Technologies Ltd. 14
Slide 14: Information to Get Before the Kick-Off
Information to Get Before the Kick-Off Get this information ready for the kick-off meeting. • How many servers and workstations? • Which server roles? (DCs, Application Servers, Linux Servers, etc) • How many of each server role? • Which operating systems? • Hardware Resources • Which teams do we ha
Slide 15: Info Throughout the Meeting
Info Throughout the Meeting • Understand the needs – map out our past experiences: • What was the experience with the former solution in place? • How did the onboarding go? Which difficulties did we have? • Did we suffer any cyber-attacks? What were the takeaways? This will help us understand how to
Slide 16: Define the Pilot Group
Define the Pilot Group The pilot group represents all the organizational OS behaviors. Workstations from Different OS Separate Pilot Different Areas Group for each Server Role • Windows • R&D • Exchange • MacOS • Finance • Domain Controllers • Linux • Application Servers • IT • etc • Etc. SK153713 S
Slide 17: Agenda
Agenda ✔ Approach (10 mins) Milestones (40 mins) ✔ Introduction ✔ Plan the Onboarding ✔ Order of Devices Set Up the Management ✔ Order of Capabilities Prepare the Pilot Group ✔ Steps per Capability Deploy ©2024 Check Point Software Technologies Ltd. 18
Slide 18: Set Up the Management
Set Up the Management 01 Create the tenant 02 Add users and define roles 03 Apply licenses 04 Enable 2FA 05 Update the client uninstallation password ©2024 Check Point Software Technologies Ltd. 19
Slide 19: Agenda
Agenda ✔ Approach (10 mins) Milestones (40 mins) ✔ Introduction ✔ Plan the Onboarding ✔ Order of Devices ✔ Set Up the Management ✔ Order of Capabilities Prepare the Pilot Group ✔ Steps per Capability Deploy ©2024 Check Point Software Technologies Ltd. 20
Slide 20: Prepare the Pilot Group for Deployment
Prepare the Pilot Group for Deployment 1. Uninstall the 3rd party EDR\AV solutions fully. 2. Replicate policies and exclusions from the prior solution. Uninstalling 3rd Party Anti-Virus Software Products ©2024 Check Point Software Technologies Ltd. 21
Slide 21: Agenda
Agenda ✔ Approach (10 mins) Milestones (40 mins) ✔ Introduction ✔ Plan the Onboarding ✔ Order of Devices ✔ Set Up the Management ✔ Order of Capabilities ✔ Prepare the Pilot Group ✔ Steps per Capability Deploy ©2024 Check Point Software Technologies Ltd. 22
Slide 22: Deployment
Deployment ©2024 Check Point Software Technologies Ltd. 23
Slide 23: Deployment
Deployment Rule Base and Policies Order of Deployment DHS Compliance Regulations Distribution Resource Consumption Logs and Exclusions ©2024 Check Point Software Technologies Ltd. 24
Slide 24: Deployment
Deployment Rule Base and Policies Order of Deployment DHS Compliance Regulations Distribution Resource Consumption Logs and Exclusions ©2024 Check Point Software Technologies Ltd. 25
Slide 25: Policies
Policies ©2024 Check Point Software Technologies Ltd. 26
Slide 26: Policy Capabilities – Rule Base
Policy Capabilities – Rule Base • POC/Test • General -Most users and non-critical systems • Important -Important users and systems -DR (Disaster Recovery) sites • Critical -Servers -C-level employees -Critical users (high impact on the organization’s operation) -Critical systems that cannot have dow
Slide 27: Deployment
Deployment ✔ Rule Base and Policies Order of Deployment Resource Consumption Distribution DHS Compliance Regulations Logs and Exclusions ©2024 Check Point Software Technologies Ltd. 28
Slide 28: Resource Consumption
Resource Consumption • Low memory mode – Behavioral Guard • Riskware Treatment - Skip File An application that isn't inherently malicious, but if exploited, it could jeopardize the environment. • Exclusions • 3rd party security applications ©2024 Check Point Software Technologies Ltd. 29
Slide 29: Deployment
Deployment ✔ Rule Base and Policies Order of Deployment ✔ Resource Consumption Distribution DHS Compliance Regulations Logs and Exclusions ©2024 Check Point Software Technologies Ltd. 30
Slide 30: DHS Compliance Regulations
DHS Compliance Regulations • Following the decision made by the US Department of Homeland Security (DHS), Check Point will cease support for non-compliant versions of Harmony Endpoint. • Our Kaspersky-based Anti-malware engines (E1) will not be updated or supported starting from the 29th of Septembe
Slide 31: Deployment
Deployment ✔ Rule Base and Policies Order of Deployment ✔ Resource Consumption Distribution ✔ DHS Compliance Regulations Logs and Exclusions ©2024 Check Point Software Technologies Ltd. 32
Slide 32: Order OF Deployment
Order OF Deployment AD Scanner Workstations Servers ©2024 Check Point Software Technologies Ltd. 33
Slide 33: AD Scanner
AD Scanner • The AD scanner synchronizes between the AD and the asset management. • Once an AD scan is configured, all objects in AD will be used in HEP to build rule bases and create policies. • Managing Active Directory Scanners ©2024 Check Point Software Technologies Ltd. 34
Slide 34: Workstations
Workstations Install Stabilize Analyze on Analyze on Detect mode Prevent Mode ©2024 Check Point Software Technologies Ltd. 35
Slide 35: Servers
Servers Server Optimization separate rules per server role Data protection and VPN blades are usually not installed. ©2024 Check Point Software Technologies Ltd. 36
Slide 36: Deployment
Deployment ✔ Rule Base and Policies ✔ Order of Deployment ✔ Resource Consumption Distribution ✔ DHS Compliance Regulations Logs and Exclusions ©2024 Check Point Software Technologies Ltd. 37
Slide 37: Deployment Is Easy When You Have Options
DEPLOYMENT IS EASY When you have options Nano Download Agent link Export Intune package ©2024 Check Point Software Technologies Ltd. 38
Slide 38: Installation
Installation Nano Agent Installation Package • Basic • Custom • Smaller than 1 MB • Less than 1GB • No capabilities are • Predefined capabilities installed • Best for servers • Best for workstations ©2024 Check Point Software Technologies Ltd. 39
Slide 39: Deployment
Deployment ✔ Rule Base and Policies ✔ Order of Deployment ✔ Resource Consumption ✔ Distribution ✔ DHS Compliance Regulations Logs and Exclusions ©2024 Check Point Software Technologies Ltd. 40
Slide 40: Review Logs
Review Logs ©2024 Check Point Software Technologies Ltd. 41
Slide 41: Logs and Exclusions
Logs and Exclusions Review logs and create exclusions • Smart exclusions • Exclusion Center • Logs • Diagnostics vBe mindful of exclusions! Note the risky potential of it. vExclude only if necessary and avoid excluding crucial values. ©2024 Check Point Software Technologies Ltd. 43
Slide 42: Diagnostics
Diagnostics ©2024 Check Point Software Technologies Ltd. 44
Slide 43: Deployment
Deployment ✔ Rule Base and Policies ✔ Order of Deployment ✔ Resource Consumption ✔ Distribution ✔ DHS Compliance Regulations ✔ Logs and Exclusions ©2024 Check Point Software Technologies Ltd. 45
Slide 44: A Leading Endpoint Solution
A Leading Endpoint Solution Leader Visionary Leader & Fast Mover Strategic Leader Frost Radar for Global Endpoint Magic Quadrant, GigaOm Radar: Endpoint Detection AV-Comparatives EPR Test Security Market Endpoint Security Platforms and Response (EDR) report “Check Point’s flagship EPP product “Compr
Slide 45: How Would You Like Your Endpoint Security Served?
How Would You Like Your Endpoint Security Served? On the Rocks Shaken, not Stirred Make it a Double It’s 5 O'clock Somewhere Endpoint Security Endpoint Security + MDR Endpoint Security + MDR + Global Services Harmony Endpoint + MSSP Platform • EPP • Investigation, • Implementation • Harmony Endpoint
Slide 46: Visit Our Webpage for the Next Steps
Visit Our Webpage for the Next Steps Get a 1:1 DEMO Start a free Watch the with a Security Expert Harmony Endpoint trial product tour video ©2024 Check Point Software Technologies Ltd. 48
Slide 47: Thank You
THANK YOU ©2024 Check Point Software Technologies Ltd. 49