What is New

Check Point Appliances

Simple to use, easily enabled for an existing Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources., and does not require any changes to your configuration on the network or client side.
Extends Threat Extraction Check Point Software Blade on a Security Gateway that removes malicious content from files. Acronym: TEX., Check Point's File Sanitization capabilities, to web-downloaded documents. Supported file types: Microsoft Word, Excel, PowerPoint and PDF formats.
Threat Extraction prevents zero-day and known attacks by proactively removing active malware, embedded content and other potentially-malicious parts from a file. Promptly delivers sanitized content to users, maintaining business flow.
Allows access to the original file, if it is determined to be safe.

Endpoint and Network compatibility includes a new mechanism that inspects files just once, either by the Security Gateway or the Endpoint client.

Advanced forensics details for Threat Prevention logs.
Ability to import Cyber Intelligence Feeds to the Security Gateway using custom CSV and Structured Threat Information Expression (STIX).
FTP protocol inspection with Anti-Virus Check Point Software Blade on a Security Gateway that uses real-time virus signatures and anomaly-based protections from ThreatCloud to detect and block malware at the Security Gateway before users are affected. Acronym: AV. and SandBlast Threat Emulation Check Point Software Blade on a Security Gateway that monitors the behavior of files in a sandbox to determine whether or not they are malicious. Acronym: TE..
Stability and performance improvements for SandBlast Threat Prevention components.
Consolidated Threat Prevention dashboard provides full threat visibility across networks, mobile devices and endpoints.

Improved understanding for security personnel of how malware analysis is performed and the reasons a file is flagged as malicious.

The Threat Detail report now includes the Malware DNA – a deeper exploration into any features that are similar to those in known malware families.

The enhanced analysis of similarities includes:

Redesigned Threat Emulation findings report for a more modern look.
The report also includes a dynamic map view of malware family appearances around the globe over time.
For more details, as well as information about the availability, refer to sk120357.

Added ability to send files via APIs to be scanned by Anti-Virus on local Check Point appliances. This capability is supported for both Security Gateways and dedicated Threat Emulation appliances.
For more information, refer to the Threat Prevention API Reference Guide.

Added new machine-learning engines focused on malware detection inside document files raising the catch rate to optimum.

Added ability for administrators to granularly configure Threat Emulation policy for different behaviors for specific errors - the administrator can decide whether to allow a file transfer based on the error type.
When administrators configure the MTA gateway to block emails in case a scan fails (fail-block), they can now also granularly configure MTA to deliver emails to the users for specific failure types.
For more details and configuration instructions, refer to sk132492 and sk145552.

Anti-Virus protections are now applied by default on files received through the MTA gateway. These protections include signatures, hashes and link reputation checks for attachments, link reputation checks for the email body, and granular enforcement based on the file type.

Security Gateways configured as MTA can now be enriched with custom Anti-Virus IOCs from external sources.

IOCs can be manually imported via the User Interface.
Links to external feeds for automatic ongoing IOC importing can be added via a configuration change.
For more information and setup instructions, refer to sk92264 and sk132193.

Added the ability to configure the MTA gateway to send and receive emails on non-default SMTP ports (ports other than 25).
For more details and configuration instructions, refer to sk142932.

Failure to inspect the attachments or links inside an email is now immediately treated as a failure.
Previously, this was treated by adding the email to the MTA queue and retrying the action. As the majority of inspection retries fail as well, this change reduces the size of the queue and improves MTA performance.

Server Name Indications (SNI)
- Improved TLS implementation for TLS Inspection and categorization.
- Next Generation Bypass - TLS inspection based on Verified Subject Name.
TLS 1.2 support for additional cipher suites
- TLS_RSA_WITH_AES_256_GCM_SHA384.
- TLS_RSA_WITH_AES_256_CBC_SHA256.
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256.
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256.
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384.
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256.
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384.
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256.
- X25519 Elliptic Curve.
- P-521 Elliptic Curve.
- Full ECDSA support.
- Improved fail open/close mechanism.
- Improved logging for validations.
- For the complete list of supported cipher suites, refer to sk104562.