ENDPOINTS AT THE EDGE: THE STAKES KEEP RISING

EXECUTIVE SUMMARY

Today’s modern IT infrastructure has enabled us to work freely outside our offices and network perimeter. We routinely use our endpoint devices to access corporate email, SaaS apps, and download documents. Remote and mobile computing has boosted our productivity, but how safe is it when research says 70 percent of successful breaches start on the endpoint?

“66 percent of respondents say their organization will experience a data breach or cybersecurity exploit that will seriously diminish shareholder value.”

In this paper we ask, “Are you prepared to prevent sophisticated endpoint cyberattacks?” If your answer is ‘No” or you’re unsure, then use our five best practices to elevate your endpoint threat prevention so it protects your organization against destructive known and unknown cyberattacks.

NETWORK-CONNECTED ENDPOINTS ARE PRIME TARGETS

Laptops, tablets, mobile phones, or other wireless endpoints (i.e., IoT) connected to the corporate network will grow to 30 billion devices by 2023. Cyberattackers have done the math and know even a miniscule number of underprotected endpoints and ill-advised user decisions represents a Greenfield opportunity. This is why exploited endpoints are commandeered as a frequent attack path for a myriad of advanced security threats.

Phishing attacks using social engineering deceive users with tainted emails and websites, leaking valuable data. The phrase, “To err is human, to really foul things up requires a computer,” unfortunately applies to users and endpoint devices. One report found 4 percent of people will click on a phishing campaign. This may seem like a small number until you realize a single wrong click exposes an organization to fraud or the theft of user credentials, customer or patient information, proprietary corporate data, and more.

FIVE BEST PRACTICES FOR BUILDING ADVANCED ENDPOINT THREAT PREVENTION

Ransomware is cyber tyranny on steroids. Locked up systems and its contents can paralyze organizations, resulting in huge financial and reputational losses and lucrative paydays for criminals. The stakes keep rising as cyber extortionists found they can target high net-worth individuals, earning the thieves an average of $360,000 a year. And if attacks by outside threat actors weren’t enough to lose sleep over, according to the Ponemon Institute, insider threats costs a global organization more than $8 million per year.

With endpoints in the crosshairs of today’s highly targeted and evasive malware threats, all organizations need to rethink their endpoint protection strategy. While signature-based antivirus plays a role in protecting known threats, it’s simply not enough in today’s threat landscape where the bad actors invent one new attack method after another, spreading malware at higher rates than ever before.

1. Reduce the attack surface

A common approach in information security is to reduce the attack surface. For endpoints, you need to take full control of peripherals, applications, network traffic, and your data. You need to encrypt data in motion, at rest, and when it’s in use. It’s also important to make sure you enforce your corporate policies to achieve endpoint security compliance.

Check Point’s SandBlast Agent offers the following capabilities to help reduce your attack surface:

• Security controls such as Port Protection, Endpoint Firewall, and Application Control.
• Encryption including IPSec and SSL VPNs, Full Disk Encryption, Media Encryption, and Document Security.
• Policy enforcement with Endpoint Compliance.

2. Prevent before it runs

The next practice is to first block known attacks by using endpoint anti-malware and reputation, and then prevent unknown attacks. Pre-execution static and dynamic analysis are recommended to provide on- and off-machine inspections. To thwart various exploits, use anti-exploit technology to prevent drive-by attacks and protect your applications. Finally, you can inhibit user mistakes by implementing zero-phishing technology that blocks phishing sites, prevents credential re-use, and detects compromised passwords.

SandBlast Agent includes the following runtime protection capabilities:

• Detect ransomware activities with Anti-Ransomware.

SandBlast Agent offers the following prevention capabilities:

• Block unknown attacks with Endpoint Anti-Malware and Reputation.
• Discover unknown malware behaviors with Behavioral Guard: Generic Rules.
• Uncover running mutations of known malware with Behavioral Guard: Malware Families.
• Prevent unknown attacks with Pre-Execution Static and Dynamic Analysis.
• Expose file-less attacks with Behavioral Guard: File-less Malware.
• Inhibit user mistakes with Zero-Phishing.

3. Contain attacks and control damages

Contain attacks and control damages by detecting and blocking command and control traffic and preventing the lateral movement of malware by isolating infected machines. You can then remediate and sterilize your environment by restoring encrypted files, quarantining files, killing processes, and sterilizing the full attack chain.

SandBlast Agent offers capabilities to contain attacks and control damage to an organization:

• Detect and block C&C traffic with Anti-Bot.
• Prevent lateral movements by isolating infected machines with Endpoint Firewall.

SandBlast Agent remediates and sterilizes environments using these capabilities:

• Restore encrypted files with Anti-Ransomware.
• Quarantine files, kill processes, sterilize full attack chain with Forensics-based attack remediation.

4. Understand and respond

The final principle is to know you must quickly triage events, understand the full nature of the attack, and immunize other surfaces by sharing Indicator of Compromise (IoC) and Indicator of Attack (IoA) information.

SandBlast Agent helps your organization understand threats and make the right responses using:

• Accurate attack status (Active, Dormant, Clean, Blocked) provides quick and efficient triage and event handling.
• Understand full attack details with Automated Forensics Reports.
• Auto-immunization of other attack surfaces (Network, Cloud, Mobile) with ThreatCloud-based intelligence sharing.
• Active threat hunting with Push Operations lets you proactively and retroactively search for observed IOCs, generate forensics reports, and remediate attacks.

SANDBLAST AGENT: COMPLETE ENDPOINT SECURITY TO MINIMIZE RISK

SandBlast Agent is Check Point’s threat prevention and response solution, providing protection to endpoints and web browsers. It leverages our industry-leading network protections, delivering complete, real-time threat prevention and remediation across all malware threat vectors. With SandBlast Agent, your users work safely no matter where they are, and without compromising their productivity.

SANDBLAST AGENT PROVIDES THE STRONGEST DEFENSE

SandBlast Agent advanced prevention capabilities have earned high ratings from the NSS Labs Advanced Endpoint Protection (AEP) test, Forrester ESS Wave Q2 2018 report, and “Top Product” by AV-TEST.

FLEXIBLE ENDPOINT SECURITY MANAGEMENT

Manage your endpoint security on-premise or delivered as a cloud service, fully deployed, maintained, updated, and optimized by Check Point. The cloud service offers high availability, elasticity to incorporate your growth, and location independence to manage from anywhere and anytime.

CHECK POINT INFINITY: INTEGRAL TO THE HOLISTIC SECURITY ARCHITECTURE

SandBlast Agent is a core component of Check Point’s Infinity Architecture protecting against advanced 5th generation, large-scale, multi-vector mega attacks across endpoint, network, mobile, and cloud.

CHECK POINT THREATCLOUD COLLABORATIVE INTELLIGENCE

Technology has improved user productivity outside the network with remote and mobile computing via portable endpoint devices. But it has also elevated the risks. Malware and unknown, zero-day threats are penetrating endpoints to harvest sensitive data from the network. Check Point recommends that you review your security strategy by comparing your current endpoint protection with our five best practices for Endpoint Threat Prevention.

CONCLUSION

“We are really pleased with the unified approach to security provided by Check Point Infinity. All of our security platforms communicate and share data with each other, which means that rather than just relying on detection, we know that we are actively preventing problems from occurring. This gives us confidence that our corporate and customer data is secure and that we are GDPR compliant.”

For further information on SandBlast Agent, contact your local Check Point representative or visit us at Check Point SandBlast Agent.