Tuesday, April 7, 2015

Is the security market ready for preemptive monitoring solutions?

How many times have you seen firewalls failing because of a subtile issue that becomes critical in time? Memory leaks, license or contract expiration, disk space running low, excessive local logging, sudden cluster failover without any obvious reason, performance issues masked by imperfect monitoring and many other things one could detect in time with a right tool.

This list could be a couple of page long only for Check Point.

Now, let's say our security and networking systems are multi-layer and multi-vendor. How to make sure your system is running fine? How to see the early tiny signs of future problems to fix them before they become critical? What do you do?

SmartView Monitor? Scripts? How often, how deep? How much effort do you spend to tune such a system?  Any?

During my 15 years I have seen just too many issues where security system failure could be prevented by early detection of the symptoms.

Some integrators and Check Point support partners even sell such monitoring as a service. Usually it is done manually, remotely or on site, on a periodic basis: a week, a month, couple of times during the year. Each of such services is an artistic piece, where experts are looking for something they know and suspect. Each one of them for something different, as their experiences are not coherent and comprehensive.

There are many niche vendors to complement well known security solutions with change management and orchestration: Tufin, Algosec, Skybox Security, Firemon, Athena and others. With so many companies there is clearly a market for such tools.

But what about preemptive monitoring? The only company I know for such matter is Indeni.

Indeni is not just for Check Point. Their product is working also with Cisco, Juniper, Fortinet, Palo Alto Networks and F5.

The tool monitors thousands of details that might indicate a failure and reports the findings as alerts. It can be deployed and integrated in half an hour. It is intuitive and simple to use.

You do not have to take my work for it. Register, download a demo and check for yourself. Or just sign up for the news from Indeni.

In my personal view, having just one vendor does not necessarily mean there is no market. On the opposite. It may mean this particular solution is going to be the next big thing.




Wednesday, April 1, 2015

Check Point is changing name to Pink Point

Did you mention lately the new colours of Check Point banners? Much pink, you say? Ever thought why?



The answer is finally revealed!

Tomorrow Check Point will change its name to Pink Point Technologies company. The domain is already reserved, DNS entries and certificates will be also transferred.

Check Point emails will remain valid for next 6 month running in parallel with pinkpoint.com extensions.

I wish the renewed company the brightest and the pinkest future! Hooray!

P.S. If you have any doubt, check the date of this post. Cheers.

Tuesday, March 31, 2015

Power-1 appliances reach end of engineering support tomorrow

Just in case you are still using Power-1 appliances, End of Engineering Support for these boxes is tomorrow. Check Point will continue supporting them in general till 01.04.2017.













End of engineering support means Check Point discontinues maintenance releases for these appliances. New software may also be incompatible.

RMAs and fixes for existing software will still be available for two more years.

For more details concerning lifetime management with Check Point please refer to this document.







Saturday, March 28, 2015

Threat Emulation incident is now under investigation

In case you are wondering what happened to the previous post about Threat Emulation issue, it has been suspended by request from Check Point security team while the issue is being investigated.

I will keep you posted about the outcome. Thanks all for understanding. 

Thursday, March 19, 2015

Does Check Point buy another startup from Shlomo Kramer?

Israeli financial newspaper "Calcalist" has published an article claiming Check Point is about to acquire Lacoon Mobile Security company - one of the security startups funded by Shlomo Kramer (Hebrew).

Lacoon Mobile Security is specialises in mobile device security solutions. Check Point is making lots of efforts to dominate this part of the information security market, so this acquisition would make a lot of sense.

"Calcalist" is also reporting that Check Point is bying Lacoon Mobile Security for $80 million.

Neither Check Point nor Lacoon are commenting on this so far.

The same sum was reported by the newspaper for previously mentioned acquisition of Hyperwise, although in this article Calcalist claims the Check Point only paid $60M.

As you may remember, Shlomo Kramer was one of the Check Point founders but left Check Point in 1998. He is arguably the most prominent Israeli investor in the security technologies field. He has founded Imperva, invested in PAN and several rather successful startups in the filed of information security.


Thursday, March 5, 2015

Check Point is not growing fast enough, apparently

Cleveland Research has distributed a security market report several days ago. Although this document is not publicly available, I am allowed to quote from it.

Look at the comparison table of security vendor's revenues:


Security Vendor Comparison

Revs ($000s)
1Q14
2Q14
3Q14
4Q14E
2014E


Checkpoint
$342
$363
$370
$421
$1,496


Y/Y
6.0%
6.6%
7.6%
8.8%
7.3%


Palo Alto*
$151
$178
$192
$204
$725


Y/Y
48.8%
58.6%
50.0%
44.5%
50.2%


Fortinet
168.90
184.10
193.30
224.00
$770


Y/Y
24.4%
24.9%
25.0%
26.3%
25.2%


Fireeye
$74
$94
$114
$143
$425


Y/Y
160.3%
184.4%
167.3%
149.7%
163.4%


















*PANW has not reported 4Q14 yet - revs based on Factset est. (Cleveland Research)

As you can see, year to year growth is quite different. Check Point has managed to achieve just above 7% growth the last year, although both PAN and Fortinet growth is tens of percents.

I can see it on the field as well. Check Point is constantly and seriously challenged by both Fortinet and Palo Alto Networks, when it come to FW security projects.

I have put FireEye in the table as well, although it is not a firewall vendor. FireEye is addressing one specific security task - APT protection. Even with just that, its revenue in 2014 is almost 30% of Check Point entire security revenue. And its growth rate is enormous.

I wonder if Check Point indeed takes this seriously. It should, in my personal opinion.





Tuesday, March 3, 2015

Mobility Blade application timeout, how-to

A customer of mine has started experiencing a weird behaviour with Mobility Blade SSL portal.

One of the application through the portal should send produce an activity report and send it as a file to the end user. It was running just fine for some time, but on a certain stage these reports were becoming bigger and bigger. Then the issue started.

If it takes more than 2 minutes to produce the report, the SSL portal application shows "Page cannot be displayed" error, and the end user never gets his report.

The problem is with CPVPND process, that cannot wait long enough for report to be produced. Here is the error that can be found in the daemon logs:

[CPCVPN_INFO/] .......... Operation too slow. Less than 1 bytes/sec transferred the last 120 seconds

This situation can be fixed by changing the waiting period for CPVPND. To do so, one has to make changes in $CVPNDIR/conf/includes/Web_inside.location.conf.

Find this line:

CvpnRequestLowSpeedTime 120

The number shows delay in seconds. Once changed, one has to run cvpnrestart  and to re-install FW policy on the portal GW.

P.S. I did not find any SK article for the matter.