PROFESSIONAL SERVICES HARMONY ENDPOINT HEALTH CHECK REPORT

EXECUTIVE SUMMARY

The following document summarizes the information collected from up to two (2) Harmony Endpoint Server(s). The project took place between [ date - begin ] and [ date - end ].

The project examined the deployment of your Harmony solution and identified opportunities to optimize your Endpoint Security Management System.

Each recommendation is rated as follows:

CONTROL CHANGE

ABBREVIATIONS

SERVER INFORMATION

LICENSE INFORMATION

License Status Report

All licenses are valid.

INTRODUCTION

[ COMPANY_NAME ] has deployed Check Point Endpoint Security to ( # ) endpoints throughout their organization.

ENVIRONMENT

• Clients communicate with the Management Server over HTTP/HTTPS.
• The Endpoint Management architecture works in a "star" scheme to support large-scale.
• The central "brain" of the system is the "Management Server" and the delegate servers are named "Policy Servers."
• Each Management Server can support a maximum of ~10,000 endpoints. Multiple Policy Servers can be chained to support a management of up to 400,000 devices from a single environment.
• The environment supports unified log reporting through SmartLog.

RECOMMENDATIONS AND BEST PRACTICES

• Check Point recommends that you install the most recent software release to stay up-to-date with the latest functional improvements, stability fixes, security enhancements, and protection against new and evolving attacks. The last version that we have seen working good is R81 and the recommended Take is the GA, at this moment it is the Take: 44.
• It is best practice and recommended to thoroughly test the latest recommended Harmony Endpoint client version before deploying to production machines. The latest recommended version can be found on the Endpoint Security Homepage, sk117536.
• The release notes for the specific client version should be reviewed carefully to ensure the Harmony Endpoint client and blades are deployed to supported client machines. The current recommended Harmony Endpoint client for Windows is E86.20; see E86.20 Endpoint Security Client for Windows Release Notes.
• Create Virtual Group for staging and troubleshooting purposes.

Detected 700 devices with object duplicated; consider deleting the duplicated objects.

Review the following list of Endpoint devices with licenses and no connectivity to Endpoint server for more than 30 days:

BLADES

There are 31 Endpoint clients not reporting the status of software blades or state unknown. This could be a general error; to fix the status of the clients, ensure processes are running in the background, and that there is connectivity to the Endpoint Management Server. If the problem persists, consider re-installing the Endpoint software.

FULL DISK ENCRYPTION

MEDIA ENCRYPTION AND PORT PROTECTION

1. Comment rule #1 and #5 (offline), and rule #1,#3,#4,#5,#7 (online) for audit and compliance purposes.
2. For client upgrade, it is highly recommended to test certain conditions before (crashes of MEPP driver MeDlpFlt reported on E86.01, solved on E86.10):
   • Encrypt device USB or HDD with E84.50.
   • Test upgrade to E86.20.
   • Validate that the USB is encrypted; the user should have access to data.

ANTI-MALWARE

Under the Anti-Malware blade, Scan Optimization action "Scan priority will be lower than other running processes" should be checked if there are performance issues with the Anti-Malware blade.

Any 3rd party Anti-Malware solution should be disabled on all machines before deploying the Endpoint Security Client. Select Randomize scan time to ensure that not all computers perform a scan for malware simultaneously.

Edit Properties - Periodical Scan Schedule

Select action:

• Anti-MW Perform periodic anti-malware scan

Exclusion area: Exclusion locations could be where the folders used by the application are located.

SANDBLAST AGENT ANTI-RANSOMWARE, BEHAVIORAL GUARD AND FORENSICS.

Anti-Ransomware, Behavior Guard and Forensics Blade Overview:

Anti-Ransomware is an automated process that creates point-in-time backups of user file data as an executable is attempting to read and write to the file system. This process generates honeypot folders and stores backups in a vault that is only readable by the Check Point system account.

Behavior Guard utilizes real-time dynamic analysis to determine executable behavior for resemblance to malware families, identifying zero-day threats in real-time.

Forensics aids from an EDR perspective by monitoring and logging executable behavior to provide forensics reports post-event.

SANDBLAST AGENT ANTI-BOT

The purpose of this blade is to monitor network traffic directed at Command and Control centers for potential instructions to pull down malicious code.

Best Practice configuration

Exclude trusted domains:

• Best Practice - Domain inspection

Exclusions for trusted entities:

THREAT EXTRACTION, EMULATION AND ANTI-EXPLOIT

Threat Extraction can quickly provide sanitized copies of potential malware before final delivery to the end-user. Anti-Exploit additionally monitors vulnerable applications for threats.

Best Practice configuration

Ensure to add known safe locations and folders for applications to avoid unnecessary risk.

ANTI-EXPLOIT ENGINE

The Anti-exploit engine evaluates highly exploitable applications and adds exceptions as necessary for false positives.

FIREWALL

Endpoint Security client installation disables Windows Defender Firewall using Microsoft's "wscsvc" service. Ensure this service is disabled before deploying the Endpoint Security Client.

APPLICATION CONTROL / URL FILTERING

This feature is currently disabled:

VIRTUAL GROUPS BEST PRACTICES

To test new Operating Systems and new hardware, create separate Virtual Groups to configure new policies transparently without affecting all devices.

1. Create a Virtual Group named Staging.
2. Create a Virtual Group for Troubleshooting, allowing temporary movement of machines to disable features or modify security policies.

SYSTEM HEALTHCHECK

Known Issues:

• EPSRV01 kernel: fwm[9054]: segfault error in libDataStruct.so.

CONCLUSION

The general feedback is that the Check Point configuration is adequate but improvements must be made towards best practices. The transition may take weeks, and Check Point Professional Services can assist through this process.

On behalf of Check Point Professional Services, I express gratitude for your loyalty.

Report Completed on: