CPET mission statement

The goal

CPET provides an innovative way to share knowledge and technology expertise for Check Point security professionals. We are going to address the full spectrum of Check Point related topics while focusing on architecture, optimization, troubleshooting and best practices. 

We do not want to replace other existing platforms and services, such as Check Point Education Services and Check Point User Group forum (CPUG). Instead, we help Check Point tech community by providing a new tool for social and professional interactions.

How

This is an independent technological initiative. We maintain integrity and transparency. We stick to the principles of CPUG community: 

- We tell the truth and help each other out.

What

We will run one hour long web seminars with an option to share a recorded version of events to those who could not participate. We plan to hold one or two seminars per month.

Who

CPET is created by Valeri Loukine (Val). Val is known for his CCMA blog and his role in CPUG community. He is also a CPUG ambassador in Europe.

We are open to other presenters and experts to help us share the load. Contact us if you want to be a speaker. 

How much does it cost?

We believe sharing knowledge is part of success. Our mission is to make CPET accessible and affordable for a wide audience. As of now, we allow free participation in the live seminars to everybody. We are also considering a subscription or a crowdfunding campaign later, for accessing the recorded sessions. We plan to figure out associated costs of CPET during the pilot phase. We reserve a right to change the CPET commercial model to provide a viable and affordable service.

Independence

We consider CPET a community service. We volunteer our personal time and efforts to the cause, freely and independently,  outside of our daily jobs and professional obligations, without affiliations with our employers and/or particular technology vendors. 

Community Support

To make the initiative a success, we need your support. Spread the word, participate in the sessions, provide your feedback, share your expertise, be proactive. 

If you want to back us up financially, make your donation.

Sponsorship

At this moment, we are open for sponsoring offers. If your company wants to support this initiative, please contact us.

Stay in touch

You can find us on Facebook and Twitter. Val’s CCMA blog will be the main tool to share information about events and to collect your feedback. You may also send us an email (cpvideonuggets (at) gmail.com).

When do we start?

The first pilot pilot will be announced in about a week from this moment. We will post the details in this blog and on social media. 

Stay tuned!

-------------
To support, send your donations to https://www.paypal.me/cpvideonuggets

CPUG papers - even better that R80 book

The last year I have made an announcement that four people decided to write a book about R80. Since then we, the authors, were working on multiple challenges, such as different writing styles, four time zone, variety of interests and preferred subjects, and finally, long delays around R80 management and gateway releases.

We have produced tons of content, we have spent multiple personal hours discussing the project, its structure, deadlines and its commercial models.

Finally, pushed back by long anticipated R80 gateway then is still not around, we have decided to revisit the original idea of a book. Then, we invented CPUG papers.

With the CPUG papers, we embrace different styles, interests and backgrounds. We are not able to release chapter, or papers, as we call them, gradually once each piece is ready. And, most importantly, we want our work to be available to the community free of charge. Today, the first CPUG paper is published: Brief History of Check Point Firewalls.

There are PDF and ePub version of the paper. All you need to access them is CPUG membership.

Thanks all for your interest and your comments.

--------------------
To support this blog send your donations to https://www.paypal.me/cpvideonuggets

Check Point merges with Palo Alto Networks

Unimaginable happens. In the just released statement Check Point Software Technologies and Palo Alto Networks announce a merger. The new company will be called CPAN - Check Point Advanced Networks.

The merger will get into effect immediately. Two companies are also merging their stock shares, bringing total capitalization to incredible 25 billions. New CPAN shares will be traded both on NASDAQ and NYSE.

Finally, it all makes sense, guys. All these 11 years it smelled fishy, but I could not put a finger on it. Yet today, 1st of April, year 2017, the mystery is in the open, finally. We have all seen the writings on the wall, but the puzzle was too complex to predict this outcome. Oh, the drama, Shakespeare is really jealous.

So, let me outline it for you, all historical details, stage by stage.

Stage 1. Largo 

In 1999 Nir Zuk, a renown Check Point engineer and brilliant developer, leaves Check Point and founds his startup OneSecure. The trap is set, and NetScreen gets into it, eventually. NetScreen is later acquired by Juniper. In 2005 Nir leaves Juniper, but his elaborate conspiracy scheme to bring it down is not yet activated.

Stage 2. Andante 

Shlomo Kramer meanwhile prepare another scene. He seemingly severs his ties with Check Point founders and goes rogue. In 2005 he reconnects with Nir and two of them create Palo Alto Networks.

Stage 3. Allegro 

PAN goes to the market with NGFW scheme. Both Fortinet and Juniper are startled, Check Point also seems not to be amused. Same time Nir finally activates his mines at Juniper, and the company starts falling down.

Stage 4. Presto 

PAN ascends on the security market like a rocket, acquiring market share from crumbling legacy firewall vendors. Mind you, Check Point maintains its market share and seems to be unaffected PAN's ride to power.

Stage 5. Fuge

Once both Check Point and PAN rise to practically the same revenues, as I mentioned in one of my recent posts, everything is ready for the grand finale. The issue of PAN's capitalization being too high for the merger is corrected at the beginning of the year after announcing caution to investors. PAK share prices declined 25% after such announcement.

Then BOOM! Two titans merge!

What a ride, guys, what a ride... I have to confess. I did not see it coming. Probably, nobody did. We all have been fooled by apparent fight and very vocal competition between two companies. And yet again, that was the textbook deception trick. That was the perfect cover!

Starting today, the world of information security is irreversibly changed. Check Point has secured its future once more - the future of market domination.

UPDATE: Just in case, this was April's fools day, guys

--------------------
To support this blog send your donations to https://www.paypal.me/cpvideonuggets

Introducing Check Point Expert Talks - CPET

Hi all!

In my previous post I have asked you about willingness to participate in a live seminars around Check Point. I was surprised and humbled by your response. About 25 percent of people who read that post participated in the survey. That is much more than I would expect.

The most popular topics are troubleshooting, optimisation and best practices. Guess what, I am teaching those courses for more than 10 years now.

Teaching a class, even a virtual one, takes lots of effort and is still limited to just tens of participants. Yet, tens of thousands of security professionals could benefit.

There are some public knowledge sharing resources such as CPUG.org and (not so public) SecureKnowledge database. The issue with both is that most if the info there, although extremely valuable, addressing very particular and mostly limited topics. Making a big picture out of those puzzle pieces is an herculean task. One more challenge is that neither platform allows an effective conversation.

Check Point Education Services have a wide network of training partners delivering official courses such as CCSA and CCSE, but they only briefly address some of the mentioned topics.

Something has to be done about it, don't you think?

My goal is to start a new mission. It has to be affordable in terms of personal time investment. Something that I could do in my free time outside of my day job workframe. It should be public and approachable. It should be regular. It should be in a form of an actual discussion, with later ability to recap the touched topic for better understanding.

Here it is - Check Point Expert Talks - CPET

I want to commence running one hour web seminars once or twice a month, on Sundays. I am planning to record the sessions and to put it somewhere participants will be able to access them later.

This is still an open idea, and there are lots of unknown about it: platform choices for both seminar and hosting videos, particular times for the sessions, associated costs and even an amount of efforts to spin this out.

Mission statement and information about a pilot run will follow the next week. Thank you very much for your support and encouragement.

-------------
To support this blog send your donations to https://www.paypal.me/cpvideonuggets

Web-based live sessions about Check Point - will you attend?

Hi all,

I am looking for new ways to share my experience and to help the community in being more comfortable with different aspects of Check Point technology and products.

What would you say about one hour web based (google hangout or similar service) video chat with shared materials and video recording for those who missed it?

To help me in doing it right and addressing the most popular subjects, please fill in a short survey by this link: https://goo.gl/forms/xO0vkuaX1ml4F4Hj2

Thanks a lot,
VL

-------------
To support this blog send your donations to https://www.paypal.me/cpvideonuggets

A phishing email - missed by mimecast, caught by Check Point

A friend of mine has got an email from his bank one day to his corporate mailbox. From the start he knew it was a phishing email. There were several clues.

Firstly, his bank does not know his corporate email address. Secondly, the only emails bank sends are the warnings not to open any emails with attachments from that bank, ever. And of course, the colleague got an email with an attached HTML file.

Being an IT guy, he is aware of the danger involved. Being a curious guy, he asked me to assist him with getting details of who attacks him and how. He asked me to assist. This is what we have done to get to the bottom of it.

1. Email headers info

The email has been sent from a private residential IP address in Spain and routed through a mail server belonging to a law firm in Santiago, Chile, most probably with weak security settings on its SMTP server. The sender's mail address was spoofed to look like the email sent from LinkedIn.

- Come on, guys, how stupid should your supposed victim be? Banking email sending messages through LinkedIn? Seriously?

My friend's company uses mimecast service to filter out  malicious emails. It was only partially effective in this particular case. In the mail header, the service flagged SMTP server as not trusted to belong to LinkedIn., Yet, the email was delivered nonetheless.

2. Attachment analysis

As mentioned, the email has an attachment with a suspicious HTML file. The file has a couple of lines of code, with obvious obfuscated payload in it. Before trying to open it, we have decided to scan it on VirusTotal. Out of 55 vendors, only Mcafee had this file previously scanned and marked malicious. That was more than suspicious, so at this point we have asked Vulnerability Research team at Check Point to assist. They have kindly agreed to help.

It turns out the obfuscated code is not a malware in a technical sense. Instead, it has a phishing page with a fake cardservice.ch dialog for collecting credit card details.

The actual link goes to a web site in Brazil, which is already closed by ISP for suspicious activity.

3. How that would look with Check Point phishing protection

One important note is that if my friend would use Check Point Anti-Phishing browser extension, even after opening an attached HTML file he would not possible fall a victim of this scam. Why? Because he would see a warning like that:

Special thanks to Oded Vanunu and Check Point Vulnerability Research team.

--------------------
To support this blog send your donations to https://www.paypal.me/cpvideonuggets

PAN revenue is expected to surpass Check Point in 2017

At the beginning of the month I have mentioned that despite slower growth at the end of 2016, Palo Alto Networks still pose a serious competition to Check Point.

According to a new report from Cleveland Research Company (not publicly available), PAN is expected to surpass Check Point's revenue this year.

The graph below is quoted from the report. It present relative revenues for each for the mentioned vendors, as well as some others. Although the title says "Market Share", in reality we are talking about revenues.

 

It is quite interesting that both PAN and Fortinet have gained quite a momentum of growth. In the last six years both competitors have managed to increase their presence drastically while Check Point goes practically flat.

It is only my personal opinion, but it seems to me Check Point has to step up its game as soon as possible, both in marketing and in sales efforts. It looks like their time is running out quickly...


--------------------
To support this blog send your donations to https://www.paypal.me/cpvideonuggets