Check Point SandBlast Agent Review

Protects against malware and phishing as well as DoS and MITM attacks

What is our primary use case?

Our use case for SandBlast Agent is that our team is set up in multiple geographies, such as, India, Sri Lanka, UK, North America, and Australia (where we have a bit of business). We have courses for an educational client which need go to market, schools, instructors for hire, and students. Given that there was COVID-19 and a lockdown, there was an increase in the digital demand for learning courses. So, we wanted to secure our courses from cyber attacks. Thus, we wanted an end-to-end security system in place that would prevent/save us from cyber attacks and protect our sensitive data.

Systems can be accessed on multiple devices, whether they be laptops, Macs, Windows, or mobile devices. Those devices could be connected to a home or public network on a platform, like a Chrome browser, Mozilla Firefox, or Safari. We have been able to track this through reports by seeing how vulnerable those agents are to attacks. Then, we determine how they can become more secure, so we can stay on the cloud and mobile devices. These are the areas where we are trying to use their reports and tighten our security, putting more systems in place to prevent attacks.

How has it helped my organization?

Cognizant had a malware attack recently, as the threat of cyber attacks has increased, and a lot of customer data was compromised. However, because this Check Point SandBlast technology was there in place, we were able to thwart the cyber attacks that were attempted. Most of the time, these attacks are college kids trying to do some phishing attacks or look into sensitive data. With SandBlast, it is possible to identify those attacks at the very source, preventing those attacks and keeping us secure.

Going forward, we are planning to extend it to authors and professors who are helping us author our content. For example, if there is an author who will be taking help from various professors in university or instructors in schools, then they will need to get their inputs. What happens is they expose their course to those authors on their networks, devices, laptops, mobiles, or tablets. They access the course through an application. Now, those authors and professors don't have an app login because they might be a third-party vendor. So, we are trying to have the SandBlast Mobile version on this site as well, based on the impressive performance of SandBlast, so our data remains secure and more users are able to utilize our systems and access our data. This will make it more valuable for our end users.

On the coverage part, there are malware, phishing, operating system exploitations, denial-of-service attacks, and man-in-the-middle attacks (MITM), so we have classified the attacks that can happen on a learning, educational system, like ours into five to six categories. With SandBlast Agent deployed in the cloud, we have good coverage to cover these attacks, as it is very extensive. The best part is (through our reports) we were able to identify the type of attacks. So far, our security has been 100 percent. We have not felt that a data breach has happened, so we are pretty happy with SandBlast Agent.

What is most valuable?

SandBlast Agent is always working in the background collecting sensitive data, forensics, and notifying users whenever there is a chance of a brute-force attack into our systems. Otherwise, it has been protecting our data at various geographies along with the endpoints that we set up on the cloud. They have been able to filter out or thwart any attacks from the very word, "Go," and make our work very safe and smooth. 

We set up reports, which were weekly or biweekly. Then, our admins, who are mainly working with SandBlast Agent, were able to look at daily reports or even more granular reports, hourly or daily, based on their customizations.

The automated part keeps it running in the background. It only gives us notifications when there have been major attempts to breach data. We also have reports that show logs for what external, unauthorized systems tried to access the data. Through those reports, which are automated in the background, we are able to do what we want in order to keep our systems secure. We feel the automation part is pretty good with this application.

What needs improvement?

It needs more documentation and better ease of deployment. For documentation, it needs more information about integrating the endpoints on SandBlast Agent mobile as well as on desktop platforms.

For how long have I used the solution?

I have been using this solution for six to eight months.

What do I think about the stability of the solution?

The SandBlast Agent is stable. Our users can work on a laptop, remote device, or tablet with this app running in the background. If an attack event is triggered, then the user and administrator both get alerts. The impact of this application running in the background on the battery life or on any other application is negligible; the battery performance is not impacted. It is such a digital world. Users are always now online and on social media, so they need to feel that their personal data is also not compromised. 

Our key 15 users maintain the solution.

What do I think about the scalability of the solution?

We have around 15 key users, but it is being used to monitor over 1,000 users across the globe. We are planning to scale it up to 1,500 users/authors in North America alone for Q4. We have also certain authors who are coming up in Sri Lanka and Australia.

We are looking to scale this up on mobile devices and tablets. We want to see how the performance will be there. With portable devices, people are sitting in a Starbucks, cafeteria, or in a public area, and we want to see how the security is established on a public network. So far, we have seen that it has been quite good during these COVID lockdowns. People who have been working from home have it also installed on shared networks with two neighbors or a group of people, which is prone to attacks. So far, it has been good, but we want to see the performance when we roll out to more users.

Which solution did I use previously and why did I switch?

We had a legacy system in place before using SandBlast Agent. The features, efficiency, and our pre-existing relationship with Check Point drove us to going with SandBlast Agent.

How was the initial setup?

When we were working with their team, it was easy to go ahead with the setup. However, once we started doing it for our users on our own, we found it to be a little complex and needed more help. So, we came back to the SandBlast support team for help.

When we had to do a second deployment, including the next 10 members from the team of 15, we found that the documentation for the initial setup wasn't thorough. Our team had to reach out to the customer support, and they were good. However, from a deployment point of view, a little more documentation would have been helpful.

The deployment took approximately three months.

Our deployment strategy was that we wanted to be digital and do things on the cloud.

What about the implementation team?

We worked with the SandBlast team for deployment and that was completed in under three months. We had our initial trial period for two weeks. We had a team of four to five members who worked with the SandBlast teams from a deployment point of view. Everything went pretty smoothly. 

Our experience with the Check Point support team was pretty good. They were able to help us with the deployment and integration for collaboration apps, like Slack, Microsoft Teams, or Jira. They also were able to help us with internal apps. So, they were able to help us with all those integration points, which was really helpful.

The staff involved was four to five members. However, we felt that if the SandBlast team was onboard, then we didn't need that many people. We could do the deployment with two members from our side and somebody helping from the SandBlast side.

What was our ROI?

If we have to look in terms of qualitative value, there has been good ROI. That is why we are planning to go ahead with the scaling of bringing more users onboard and having our security being taken care by SandBlast.

The solution has reduced the number of security analysts we have needed, enabling them to work on things they didn’t have time for before. From the automated reports point of view, we always used to feel that for whatever legacy system that we had in place we had to do more work to capture the area we wanted in our reports. With SandBlast Agent, we are able to do that through automated reports and its inbuilt functionality for reporting.

Due to a combination of factors, we now have three security analysts instead of six. So, we are almost down to 50 percent of team strength from the point when we started using SandBlast Agent. We have been able to cut down the cost after starting to use this platform.

What's my experience with pricing, setup cost, and licensing?

One of the key factors that made us go with this solution was the pricing. 

On the licensing part, there was an initial complementary set of licenses offered in the initial onboarding package, either 15 or 20. Then, we had some complementary licenses in the initial purchase of the package. That was pretty useful.

Which other solutions did I evaluate?

We did explore one more option, which was an offering from Microsoft. The features, efficiency, price point, and pre-existing relationship that we had with Check Point made us go with SandBlast Agent. 

Some of SandBlast's features include ease of deployment on cloud and mobile device coverage, which is our future coverage area. We found that it gave us good operational efficiency on mobile devices. It runs in the background, providing coverage for various parameters in the logs and triggering alerts to users and administration only when there is an attack. Otherwise, it is able to block the attack, URL, or user in the background before notifying them. These are some of the features that stood out and differentiated it from Microsoft Windows Defender.

What other advice do I have?

In this digital ecosystem, we need to secure our data at every moment and have something in place, like SandBlast, to keep our networks scanned at each moment. You never know where the next attack is coming from: malware, phishing, denial-of-service attacks, man-in-the-middle attacks, etc. Therefore, we need to be on the lookout for these type of attacks and any other unauthorized URLs trying to get into our systems to access data for any purpose. 

Have a system in place to keep your data secure. You should definitely give SandBlast Agent a try. It is worth it. The solution is very secure and has very impressive features.

I would rate this solution as an eight out of 10. We are very impressed and happy with the features, its stability, reports, and the parameters covered in the reports. 

Which deployment model are you using for this solution?

Public Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Amazon Web Services (AWS)
**Disclosure: IT Central Station contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor. The reviewer's company has a business relationship with this vendor other than being a customer: Partner
More Check Point SandBlast Agent reviews from users
Add a Comment