December 28, 2021

Cheap and effective solution for 0day detection and prevention

Verified User

Supervisor in Information Technology

Banking Company, 10,001+ employees

Score 9 out of 10

Vetted Review

Verified User

Incentivized

Use Cases and Deployment Scope

Check Point ThreatCloud is the core of Checkpoint products and services for intelligence sharing, threat exchange, detection, and prevention. It’s unique in terms of integrating at endpoint devices, networking devices, and cloud GWs and even on CSPM services. We generally purchase the perimeter next-generation firewalls with TX modules. TX and TP modules are automatically integrated with [Check Point] ThreatCloud. I prefer the TE and TX with cloud-enabled. This lowers the cost of operations. Even the TP modules are integrated with the threat cloud. TPs are not meant to be zero-day. However, mixing the TE/TX with TPs decreases the 0day catching times. NGFWs without TP even use [Check Point] ThreatCloud indirectly. Malware URLs/IPs are exchanged through [Check Point] ThreatCloud. We measure the effectiveness of [Check Point] ThreatCloud through cyber breach solutions. [The] last thing I want to mention and which is really shining is the Cloudguard CSPM and [Check Point] ThreatCloud. Colorguard/dome9 with [Check Point] ThreatCloud enablement based on the flow data is the real enhancer to dig out the missing security links throughout the Cloud installation. Last but not the least, Infinity portal integration with [Check Point] ThreatCloud completes the 360-degree overall threat hunting and forensics.

Pros and Cons

Threat prevention modules
Threat extraction modules
Threat emulation modules
Cloudguard with Threat Intelligence on the cloud with CSPM/dome9
NG firewalls with APP and URL enabled
Harmony Endpoints integrated with Infinity portal
Threat forensics and analytics on the cloud

SOAR integration, Checkpoint does not have built in SOAR
Automation throughout the findings of [Check Point] ThreatCloud
Special team for threat intelligence
K8s threat cloud integration and K8S forensics
Native SIEM integration

Likelihood to Recommend

If you have the Check Point environment and want to utilize the Checkpoint environment, you should use the [Check Point] ThreatCloud. Without [Check Point] ThreatCloud, there’s no way to stop the 0days or APTs. However, [Check Point] ThreatCloud relies on the Checkpoint infrastructure to be used and integrated. If you have other firewall and/or endpoint vendors, [Check Point] ThreatCloud is not the best service to be used. Checkpoint also offers 24x7 threat cloud-managed security services to [...] organizations. Threat cloud-managed security services leverage the threat cloud decreasing the detection time and false-positive rates via increasing protection rates.

Most Important Features

Checkpoint internal research lab
Number of TIX indicators on the cloud is really high
Catching the 0days and targeted attacks
Preventing the users accessing dangerous sites and downloading malware
Solid security solution without decreasing the uptime
Full solution including IPS, URL, Malware, Bot, DNS security
Packet capture and forensics at the detection as well as the prevention
Ability to implement on premise as well as in cloud

Return on Investment

High score rates [are] seen on breach systems after deploying systems integrated with [Check Point] ThreatCloud
Catch rates are very high compared to other vendors
One missing thing is the detection for localized URLs and IPs
Purchasing within the 3-year perspective is cheap compared to other solutions; ROI is generally six months
[Check Point] ThreatCloud eliminates the need [for] other additional services that may need to be deployed like dedicated IPS, Dedicated Sandbox, DNS solution, etc.

Alternatives Considered

Palo Alto Networks AutoFocus, FortiGuard Web Filtering Service and Symantec WebFilter / Intelligence Services

If you have the Checkpoint firewalls, the only real solution is the Check Point ThreatCloud to be used. If you have PAN - Autofocus or Fortinet-fortiguard. One advantage of Check Point ThreatCloud is the elimination of web security services, as the checkpoint with the threat cloud replaces the web security solutions with its vast features. Check Point products are very easy to use, and operation costs are much lower than the other vendors.

Other Software Used

Palo Alto Networks Advanced URL Filtering, Fortinet FortiGate, Cisco Firepower 4100 Series

November 08, 2021

ThreatCloud - Next generation Threat Protection

Verified User

Team Lead in Information Technology

Banking Company, 1001-5000 employees

Score 8 out of 10

Vetted Review

Verified User

Incentivized

Use Cases and Deployment Scope

Check Point ThreatCloud is being used across the network to keep the network secure. It helps online and offline based on reputationally and malware databases as anti virus and anti bot ware.

Pros and Cons

anti virus
anti bot

I personally feel that online guides and reads to gather information about this product are limited.

Likelihood to Recommend

As I'm working for the banking sector, our utmost importance is the security of the network. Check Point ThreatCloud helps to ensure the security by making sure the threats are monitored and treated according to the Bank's IT policy. When it comes to the ATM Network, Check Point ThreatCloud plays a severe role.

Most Important Features

Threat Intelligence
Updates and definitions

Return on Investment

Threat Free Network
Overall IT Security

Alternatives Considered

Sophos Managed Threat Response (MTR)

As Checkpoint next generation firewalls were already implemented in the network, ThreatCloud was easy to implement and had better features and reputation than competitors.

Other Software Used

Foxit PDF SDK, Adobe Acrobat Reader DC

Operating Systems	Unspecified
Mobile Application	No

Check Point ThreatCloud

AlienVault USM

Egnyte

Palo Alto Networks AutoFocus

VirusTotal

Mimecast Threat Intelligence

Palo Alto Networks Advanced Threat Prevention

Huntress

Recorded Future Intelligence Cloud

Splunk Enterprise Security (ES)

Mandiant Advantage Threat Intelligence

Cisco SecureX

Anomali ThreatStream