SandBlast

Threat Emulation Appliances

Product Benefits

• Prevent new and unknown attacks in documents and executable files
• Makes it virtually impossible for hackers to evade detection
• Reduces costs by leveraging existing security infrastructure
• Maximize protection through unified management, monitoring, and reporting
• Increase security with automatic sharing of new attack information with ThreatCloud™

Product Features

• Identify new malware hidden in over 40 files types, including: Adobe PDF, Microsoft Office, Java, Flash, executables, and archives
• Protect against attacks targeting multiple Windows OS environments
• The range of available appliances covers any performance need
• Threat Extraction removes exploitable content to deliver clean files without delay
• Unique CPU-Level technology catches malware before it has an opportunity to deploy and evade detection

With the increase in sophistication of cyber threats, many targeted attacks begin with exploiting software vulnerabilities in downloaded files and email attachments. New and undiscovered threats require new solutions that go beyond signatures of known threats.

SandBlast Zero-Day Protection

Check Point SandBlast Zero-Day Protection, with evasion-resistant malware detection, provides comprehensive protection from even the most dangerous attacks while ensuring quick delivery of safe content to your users. At the core of our solution are two unique capabilities—Threat Emulation [sandboxing] and Threat Extraction [Content Disarm & Reconstruction] that take threat defense to the next level.

Evasion-resistant Sandbox

As part of the Check Point SandBlast solution, the Threat Emulation engine detects malware at the exploit phase, even before hackers can apply evasion techniques attempting to bypass the sandbox. Files are quickly quarantined and inspected, running in a virtual sandbox to discover malicious behavior before it enters your network. This innovative solution combines CPU-level inspection and OS-level sandboxing to prevent infection from the most dangerous exploits, and zero-day and targeted attacks.

Content Disarm & Reconstruction (CDR)

In addition, the SandBlast Threat Extraction (CDR) capability immediately provides a safe version of potentially malicious content to users. Exploitable content, including active content and various forms of embedded objects, are extracted out of the reconstructed file to eliminate potential threats.

Access to the original suspicious version is blocked until it can be fully analyzed by SandBlast Zero-Day Protection. Users have immediate access to content and can be confident they are protected from the most advanced malware and zero-day threats.

SANDBLAST APPLIANCES

We offer a wide range of SandBlast Appliances. These are perfect for customers who have regulatory or privacy concerns preventing them from using the SandBlast Threat Emulation cloud-based service.

SandBlast Deployment Options

Deployment Options

Emulate threats in one of two deployment options:

1. Private cloud: Check Point security gateways send files to an on-premises SandBlast appliance for emulation
2. Inline: This is a stand-alone option that deploys a SandBlast Appliance inline as MTA or as an ICAP server or on a SPAN port, utilizing all threat prevention technologies, including IPS, Antivirus, Anti-Bot, Threat Emulation, Threat Extraction, URL Filtering, and Application Control.

Complete Threat Prevention Solution

SandBlast Appliances protect you from both known and unknown threats utilizing IPS, Antivirus, Anti-Bot, Threat Emulation [sandboxing], and Threat Extraction (CDR) technologies.

Known Threat Detection

Antivirus uses real-time virus signatures from ThreatCloud™ to detect and block known malware at the gateway before users are affected. Anti-Bot detects bot-infected machines, preventing damages by blocking bot Command & Control communications.

Unknown Threat Protection

The SandBlast Threat Emulation technology employs the fastest and most accurate sandboxing engine available to pre-screen files, protecting your organization from attackers before they enter your network. Traditional sandbox solutions detect malware behavior at the OS level—after the exploitation has occurred and the hacker code is running. They are therefore susceptible to evasion. SandBlast Threat Emulation capability utilizes a unique CPU-level inspection engine which monitors the instruction flow at the CPU-level to detect exploits attempting to bypass OS security controls, effectively stopping attacks before they have a chance to launch.

SandBlast Content Disarm & Reconstruction [CDR]

Promptly Deliver Safe Content

When it comes to threat prevention, there doesn't have to be a trade-off between speed, coverage, and accuracy. Unlike other solutions, Check Point Zero-Day Protection can be deployed in prevent mode while still maintaining uninterrupted business flow.

SandBlast Threat Extraction removes exploitable content, including active content and embedded objects, reconstructs files to eliminate potential threats, and promptly delivers sanitized content to users to maintain business flow.

Configure Threat Extraction in one of two ways:

Quickly provide a reconstructed document to the user, or await response from SandBlast Threat Emulation before determining whether or not to reconstruct the document.

Inspect Encrypted Communications

Files delivered into the organization over SSL and TLS represent a secure attack vector that bypasses many industry-standard implementations. Check Point Threat Prevention looks inside these protected SSL and TLS tunnels to extract and launch files to discover hidden threats.

Threat Emulation Detailed Reports

Every file emulation generates a detailed report. Simple to understand, the report includes detailed forensic information about any malicious attempts originated by running this file. The report provides actual screenshots of the simulated environments while running the file.

Part of the ThreatCloud Ecosystem

For each new threat discovered by Threat Emulation, a new signature is created and sent to Check Point ThreatCloud, where it is distributed to other Check Point products. Threat Emulation converts newly identified unknown attacks into known signatures, making it possible to block these threats before they have a chance to become widespread. This constant collaboration makes the ThreatCloud ecosystem the most advanced and up-to-date threat network available.

SandBlast Specifications

Threat Emulation

Emulation Environments

PC: Windows:

• Win 7 32 bit, Office 2013
• Win XP
• Win 7 32 bit, Office 2003 / 2007
• Win 7 32 bit, Office 2010
• Win 7 64 bit
• Win 8.1
• Win 10 MacOS: MacOS OSx* *static analysis

File Types

• Over 70 file types emulated, including: Microsoft Office documents and templates, EXE, DLL, Archives [ISO, ZIP, 7Z, RAR, etc.], PDF, Flash, Java, scripts, ELF executable [MacOS, Linux] and more

Archive Files

• Archived [compressed] files
• Password protected archives

Protocols

• HTTP, HTTPS, SMTP, SMTPS, IMAP, CIFS, SMBv3, SMBv3 multi-channel, FTP

Threat Extraction

Extraction Modes

• Clean and keep original file type
• Convert to PDF

File Types

Web downloads and email attachments in these formats:

• Microsoft Word
• Microsoft PowerPoint
• Microsoft Excel
• Adobe PDF
• Image files

Extracted Content

Over 15 extractable component types including:

• Macros and Code
• Embedded Objects
• Linked Objects
• PDF JavaScript Actions
• PDF Launch Actions

Protocols

• Web downloads: HTTP, HTTPS, ICAP
• Email attachments: SMTP, IMAP, PDP3, SMTPS—MTA deployment

SandBlast Appliance Specifications

Environment

Operating

• 32° to 10/4F / 0° to 40°C, (5 - 95%, non-condensing)

Storage

• -4° to 158°F / -20° to 70°C, (5 - 95% non-condensing)

Power

• Dual, hot swappable Included
• AC input: 100-240V, 47-43 Hz
• Power supply rating: 500W
• Power consumption avg/max: 144W/270W
• Max thermal output: 921 BTU/h.

Certifications

• Safety: UL, CB, CE, TUV GS
• Emissions: FCC, CE, VCC, RCM/C-Tick
• Environment: RoHS, WEEE

Performance numbers are based on unique files scanned which typically represent 20 to 30% of the total number of files. Most files are retransmissions of files seen before. These known files are processed based on the file hash without impacting the appliance performance. Performance based on:

• File blend. A blend of unique files representing real world mail and web traffic
• Emulation environment. Check Point recommended images for emulation
• Distributed topology, an inline security gateway sending files for emulation to a SandBlast appliance.

Ordering SandBlast Appliances

Ordering TE2000XN

TE2000XN BASE CONFIGURATION¹

TE2000XN SOFTWARE PACKAGES²

TE2000XN NETWORK CARDS AND TRANSCEIVERS

TE2000XN SPARES AND MISCELLANEOUS

Ordering TE250XN

TE250XN SOFTWARE BASE CONFIGURATION

• The SandBlast Appliance must be covered by an SN8T software package when deployed inline, as MTA or as an ICAP server / SKUs for 2 and 3 years are available, see the online Product Catalog.

TE250XN SPARES AND MISCELLANEOUS

Headquarters

• Worldwide Headquarters: 5 Shilomo Kaplan Street, Tel Aviv 6789159, Israel | Tel: +972-3-753-4599
• U.S. Headquarters: 100 Oracle Parkway, Suite 800, Redwood City, CA 94065 | Tel: 1-800-429-4391
• www.checkpoint.com