Check Point CloudGuard Code Security

My team and I work with Check Point CloudGuard Code Security  and handle all related tasks, including deploying virtual machines and configuring all aspects.

Our security team's roles include networking security, and our responsibility is to deploy all firewalls across our organization's sites, both on-premises and in the cloud.

The most valuable features of Check Point CloudGuard Code Security  include our approach to manage it via the management we have on-premises, and we also deploy the same extension management of CloudGuard to manage all the virtual systems on Azure .

We effectively use artificial intelligence with Check Point CloudGuard Code Security, as we have teams that work with AI and we frequently manage our firewalls using AI along with the CloudGuard and all virtual systems.

There are still areas for improvement with Check Point CloudGuard Code Security. All the features we have on the firewall on the on-premises side, we also have under CloudGuard such as IPS, Anti-Bot, and all these blades are set up in our CloudGuard.

The initial setup of Check Point CloudGuard Code Security is very challenging because it requires more preparation, and we need more guides to understand how to set up all aspects.

I would rate the support for Check Point CloudGuard Code Security as good because we can quickly email support about any problems we encounter, and they reply instantly to provide help. I would give it an eight.

To deploy Check Point CloudGuard Code Security, it requires four people on our team to manage all the Check Point devices.

Some challenges with Check Point CloudGuard Code Security include that we noticed FortiGate  is much more efficient on AWS , and our team prefers to deploy FortiGate  there instead of CloudGuard due to the management challenges on the cloud.

I do not have experience with CyberArk, we only work with VSX  and the family of VSX , which is provided by Check Point.

I can recommend Check Point CloudGuard Code Security to other organizations as it is a good platform to protect our organization. On a scale of one to ten, I rate this solution an eight.

The primary use case of this solution is to detect vulnerabilities, prevent breaches, accelerate development, and improve code quality.

It helped us to reduce vulnerabilities, improve code quality, enhance security posture, and offer us good cost savings.

The solution's most valuable aspects include its accurate vulnerability detection, deep code analysis, remediation guidance, false positive guidance and customizable rules.

The solution should improve vulnerability in-depth, false-positive reduction, integration with other tools, performance optimization, and the user interface.

I've used the solution for two years.

The stability is good.

The scalability is good.

Technical support is good but can be improved.

No, I did not use another solution.

The initial setup is straightforward.

We implemented the solution with an in-house team.

The ROI is nice.

Pricing and licensing modules need to be improved.

No, I did not evaluate other options.

It was adopted in response to the events of SolarWinds, where API credentials were leaked into Git repositories or other developer tools. We, at the time, had no detective or preventive controls to prevent this sort of disclosure, so CloudGuard Code Security was implemented into the pipelines themselves to detect secrets being disclosed.

We have had a number of real events where developers accidentally made commits of API keys, and we were able to detect and begin response actions in minutes. We had the API key revoked in less than five minutes in such events. If we did not have CloudGuard Code Security, we would not have known about it for who knows how long. There is absolutely a very meaningful difference.

CloudGuard Code Security is great for protecting our code and assets from exposed API keys, tokens, or credentials. It does exactly what is advertised, and it does it reliably. It is a great solution.

The scanning of code throughout development helps save developers time. One of the important attributes of the shift-left movement was getting developer feedback as quickly as possible to reduce cycle time and context switching. CloudGuard Code Security very much improves that by allowing the mistakes to be detected almost immediately and remediation efforts to be implemented. In terms of time saved from not having to redo problematic production code, context switching is about a 30-minute loss for most developers. Each incident is 30 minutes. Hopefully, it is infrequent. There are two pieces. There is secrets detection, which is not an efficiency play. It is risk mitigation because of the enormity of the impact that it could lead to. The other side of it is the configuration management side. That is where you do have ongoing feedback as people use TerraForm or other infrastructure as code languages, and getting that feedback to them quickly is certainly valuable. It saves a lot of time there.

CloudGuard Code Security helps identify high-risk security misconfigurations in our code during the development phase. On the merge event, for the infrastructure as code, it analyzes the configurations. It looks for known adverse configurations and comments on the merge request. It usually prevents the merge request from happening to begin with, and then you have a commit, which hopefully remediates the issue. It probably has had some beneficial impacts on product security, but it did not necessarily create new visibility that did not exist before. CSPM tools from Check Point give us visibility into adverse configurations, but we saw them later on or down the line, and we had to deal with making people go back and fix them, so I do not know if it had a massive change on the outcome, but it has impacted the efficiency of getting to the outcome.

CloudGuard Code Security has helped our development team adopt a security mindset. It keeps security on top of mind when dealing with infrastructure as code or secrets and ensures that it does not get lost or overlooked. If they are aware of security and it is on top of mind, hopefully, they will make better decisions.

The time taken by CloudGuard Code Security to scan our codebase depends on the size of the Git Repo, but on average, it is between ten seconds to a minute.

CloudGuard Code Security does not impede the development flow because the inflection point for the most part is on the merge request creation. In most organizations, especially if they are in any sort of highly regulated space, the creation of the merge request is usually followed by approvals from peers or partners on the merge before it is merged. With a latency of ten seconds to a minute, most of the time, approvers have not even opened the page before the contextually rich security information is already there waiting for them to make a good decision. So, it does not impede the development flow at all. It just means that the approvers have the ability to make rich decisions with all of the information already laid out for them.

Secrets detection is the bread and butter.

We have used the infrastructure as code as well. It was really early in the market and had comprehensive coverage across Terraform, cloud formation, and ARM. We used that as well but not as heavily. It was more of an ancillary benefit.

There are a lot of opportunities for how they can use their technology to do more. That would be more like sensitive data discovery and other things besides Git Repos, but then you are expanding the scope of what necessarily their product is. If we talk about what problem we are trying to solve, which is secrets disclosure, perhaps even validation of configuration management inside of Git environments, it is a very comprehensive solution. It is what it is, and it does a great job.

We have been using CloudGuard Code Security for three and a half years.

It is bulletproof.

It uses Lambda as its backend, so it is really a question about the scalability of AWS, which is bulletproof.

It is integrated into our Git Repo, so it is a Git-level control. The users of Git exist across locations, departments, and knowledge domains. It is a universally applied control irrespective of the employees. It broadly affects any user of Git across the company.

When we first launched this, it was a brand-new product, and there was very hands-on support. We had a couple of issues that they worked through very effectively and efficiently. They were super responsive. For the last two years, I have not talked to their support at all because it has just worked.

We have got great service from Check Point. I would rate them a nine out of ten.

We did not use any other solution previously.

The deployment was very fast. It probably took my team a day to wire in the integration with the Git side. We did a little bit of SOAR work to make sure our response was efficient. It was a very quick and painless setup.

In terms of the deployment model, it is a webhook from a Git Repo into a Lambda function hosted in our AWS account that scans and then replies back. That would be considered a self-hosted public cloud.

It was very simple. It was done three years ago. I am sure things have changed, but at the time, it was a cloud formation stack set that was deployed into an account, and then there were a couple of configuration pieces in Git Repo where you need to point the webhook to the Lambda function you have stood up, and that was it. You were done. I imagine there is a slightly different process today for CloudGuard Code Security than three years ago. It is probably a little bit more fully managed on their end today, but I do not know that for sure.

We did not take any external help. It was very easy.

The thing we are trying to stop is a really bad SolarWinds type of event, which would cost an organization millions of dollars, so the ROI is preventing that outcome. It is a risk mitigation play. There is not necessarily a strong ROI from a non-event.

It is extremely affordable and high value for cost.

When we bought it three years ago, as far as I know, there were no other options. This was the first to market.

To those evaluating CloudGuard Code Security, I would advise doing a PoC. It is easy to integrate. It takes a day to get it all set up and working. Do some testing on merging things that you know would be bad and watch what happens. The product sells itself.

I would rate CloudGuard Code Security a ten out of ten.

Our primary use case involves protecting our internal services hosted within our data center's cloud environment, which includes virtual machines housing critical company resources. Additionally, we safeguard external services used by our customers with Check Point security measures.

The benefits derived from utilizing Check Point solutions for achieving our security objectives primarily lie in bolstering threat prevention and network security measures. This includes safeguarding against various threats, such as vulnerabilities and potential attacks.

It offers robust security capabilities spanning multiple cloud environments, which is highly beneficial. The platform is user-friendly, especially with its multi-domain solution.

We have a strong sense of security assurance when utilizing CloudGuard, as it consistently delivers outstanding protection capabilities.

The most critical features for me revolve around security, as I primarily focus on network engineering.

The enhancements are needed in the logging system and log management processes. Additionally, we encounter issues with geolocation functionality, which is crucial for enforcing access restrictions based on location. While we heavily rely on this feature, it occasionally fails to function correctly, posing challenges to our security measures.

I have been using it for two years.

It provides excellent stability capabilities.

In terms of scalability, our infrastructure comprises a private cloud with eight hundred servers and a public cloud serving our customers. Within this setup, we manage their database applications, application sites, disaster recovery mechanisms, and all security measures without encountering any issues.

The technical support is satisfactory; they respond promptly, and I am pleased with their service. I would rate it nine out of ten.

In my previous roles, I've gained experience working with FortiGate  and Cisco firewalls, each offering its own set of advantages. FortiGate  stands out for its user-friendly configuration interface, yet it faces stability issues in certain regions, particularly with routing tables. Cisco, on the other hand, provides a unified management platform for network configuration, which simplifies tasks for some networks. However, I've found Check Point to be my preferred choice over the past two years due to its exceptional stability. Unlike Cisco, which has been prone to crashes in my experience, Check Point has consistently delivered reliability. While FortiGate is known for its ease of use and Cisco for its complexity, Check Point falls somewhere in the middle in terms of usability. Compared to other vendors, Check Point excels in identifying threats effectively.

We selected CloudGuard due to its stability and because our team has extensive experience with it. We are highly satisfied with it.

Configuration is also simple and not overly complex.

For deployment, our integration with NSX is seamless, quick, and efficient.

We've experienced a positive return on investment with its usage, primarily through time savings attributed to its stability and user-friendly administration. Working with it is straightforward and not overly complicated, allowing us ample time for other tasks.

Renewing licenses is relatively simple, though there is room for further streamlining the process.

Overall, I would rate it eight out of ten.