Check Point Incident Response Service

Check Point is the only company to offer insight and remediation for several different types of threats including:

• Firewall
• IPS
• Applications
• Data Loss
• Malware
• Botnets
• Unauthorized access
• Denial of Service

Incident Response customers receive detailed documentation and best practices guidelines to improve processes, speed ability to respond to an attack and meet compliance and reporting requirements including:

• Incident Response Analysis and Recommended Remediation
• Incident Response Best Practices Guidelines
• State of Preparedness Report
• Annual Summary of Event Activity vs. the Check Point community
• Attack Profiling

The Incident Response portal offers everything you need to prepare for and respond to a security attack. Via the Incident Response portal customers can view actionable attack remediation data including:

• Summary of the Security Event
• Summary of Alerts during the last 24 hours
• Message Board
• Report Repository

Customers upload their raw data (logs) to the Incident Response portal for encrypted storage and analysis.

In addition to real-time attack remediation assistance, we also provide expert recommendations to enhance your security protection including:

• Custom signatures
• Traffic and attack analysis
• Rule-base protection activations
• Custom protection development
• How to protect 3rd party systems and service providers

ThreatCloud is a real-time security intelligence database, and the first collaborative network to find cybercrime by analyzing over 250 million addresses for Bot discovery, 4.5 million malware signatures, and 300,000 malware-infested websites. ThreatCloud is dynamically updated using a worldwide network of threat sensors to provide the very latest security intelligence.

Scope

Within thirty (30) minutes of receiving the call, an Engineer will contact Customer and a conference bridge will be established where all parties can join in on the private conference call.

Once initial contact has been created, an Engineer will work with the customer to identify the type of incident and proceed through the analysis phase, which can include investigation of anomalies associated with:

• System resources
• Network Patterns
• Application performance
• Device operation

Engineer may also perform log analysis from Check Point products, network equipment and device operating systems and applications. Additional investigative efforts may include reviews of full packet captures and binaries

Deliverables

Within 48 hours of an Incident being closed, Check Point will provide a full report of the circumstances of the Incident to the Customer.  The clock will start once the Customer has indicated that the incident is closed. The report may include:

• Incident overview and executive summary information
• Event description and behavior
• Details of call log and work performed
• Data and system/network behavior analysis
• Recommendation and analysis
• Raw log information