11. Check Point Getting Started R80.20. Threat Prevention Policy

Welcome to Lesson 11! If you remember, back in lesson 7 we mentioned that Check Point has three types of Security Policy. This:

1. access control;
2. Threat prevention;
3. desktop security.

We have already covered most of the blades from the Access Control policy, the main task of which is to control traffic or content. Blades Firewall, Application Control, URL Filtering and Content Awareness allow you to reduce the attack surface by cutting off all unnecessary. In this lesson, we will look at the policy Threat Prevention, whose task is to check the content that has already passed through the Access Control.

Threat Prevention Policy

Threat Prevention policy includes the following blades:

1. IPS - intrusion prevention system;
2. Anti-Bot — detection of botnets (traffic to C&C servers);
3. Anti-Virus — checking files and url;
4. Threat Emulation - file emulation (sandbox);
5. Threat Extraction - cleaning files from active content.

This topic is VERY extensive and unfortunately our course does not include a detailed discussion of each blade. This is not a topic for beginners. Although it is possible that for many Threat Prevention is almost the main topic. But we will look at the process of applying the Threat Prevention policy. And also we will conduct a small but very useful and indicative test. Below, as usual, is a video tutorial.
For a more detailed acquaintance with the blades from Threat Prevention, I recommend our previously published courses for review:

• Check Point to the maximum;
• Checkpoint SandBlast.

You can find them here.

Video tutorial

Stay tuned for more and join us YouTube channel : )

Source: habr.com