Cheap and effective solution for 0day detection and prevention
Rating: 9 out of 10
IncentivizedUse Cases and Deployment Scope
Check Point ThreatCloud is the core of Checkpoint products and services for intelligence sharing, threat exchange, detection, and prevention. It’s unique in terms of integrating at endpoint devices, networking devices, and cloud GWs and even on CSPM services. We generally purchase the perimeter next-generation firewalls with TX modules. TX and TP modules are automatically integrated with [Check Point] ThreatCloud. I prefer the TE and TX with cloud-enabled. This lowers the cost of operations. Even the TP modules are integrated with the threat cloud. TPs are not meant to be zero-day. However, mixing the TE/TX with TPs decreases the 0day catching times. NGFWs without TP even use [Check Point] ThreatCloud indirectly. Malware URLs/IPs are exchanged through [Check Point] ThreatCloud. We measure the effectiveness of [Check Point] ThreatCloud through cyber breach solutions. [The] last thing I want to mention and which is really shining is the Cloudguard CSPM and [Check Point] ThreatCloud. Colorguard/dome9 with [Check Point] ThreatCloud enablement based on the flow data is the real enhancer to dig out the missing security links throughout the Cloud installation. Last but not the least, Infinity portal integration with [Check Point] ThreatCloud completes the 360-degree overall threat hunting and forensics.
Pros
- Threat prevention modules
- Threat extraction modules
- Threat emulation modules
- Cloudguard with Threat Intelligence on the cloud with CSPM/dome9
- NG firewalls with APP and URL enabled
- Harmony Endpoints integrated with Infinity portal
- Threat forensics and analytics on the cloud
Cons
- SOAR integration, Checkpoint does not have built in SOAR
- Automation throughout the findings of [Check Point] ThreatCloud
- Special team for threat intelligence
- K8s threat cloud integration and K8S forensics
- Native SIEM integration
Likelihood to Recommend
If you have the Check Point environment and want to utilize the Checkpoint environment, you should use the [Check Point] ThreatCloud. Without [Check Point] ThreatCloud, there’s no way to stop the 0days or APTs. However, [Check Point] ThreatCloud relies on the Checkpoint infrastructure to be used and integrated. If you have other firewall and/or endpoint vendors, [Check Point] ThreatCloud is not the best service to be used. Checkpoint also offers 24x7 threat cloud-managed security services to [...] organizations. Threat cloud-managed security services leverage the threat cloud decreasing the detection time and false-positive rates via increasing protection rates.
