Press
Check Point Users: You Are Not Ready for June 5th, 2016

Check Point Users: You Are Not Ready for June 5th, 2016

Published on: August 9, 2015

Key Takeaways

Check Point is transitioning its online update services from SHA-1 to SHA-256 certificates due to known and anticipated cryptographic weaknesses in SHA-1.
To maintain connectivity to Check Point online update services using SHA-256 certificates, a specific hotfix or upgrade to R77.30 is required on all firewalls and management servers.
The rollout of SHA-256 certificate usage by Check Point was postponed to June 5, 2016, but systems must still be prepared before the enforced cutoff.
Only 17.9% of Check Point firewalls observed in the referenced dataset were compliant (running R77.30 or the required SHA-256 hotfix), indicating widespread exposure to potential update failures.
Operators should inventory all Check Point devices, verify installed software versions and hotfixes, and ensure the presence of either an R77_30 or SHA256-related hotfix per device.
According to Check Point’s support documentation (SK103839), deploying the required hotfix across the environment should not cause downtime, enabling proactive remediation.

UPDATE May 31st 2016: Check Point has updated the SK. The rollout of SHA-256 has been postponed to June 5th 2016.

Back in April 2015, Check Point published SK103839. In it, Check Point informs its customers that the update services for the various software blades will start using SHA-256 instead of SHA-1. This is in response to reports that SHA-1 has weaknesses that, if not already overcome by hackers, may be overcome as soon as 2018. Check Point is not alone in this effort, Google and other vendors are at it, too.

As the SK states, “To ensure the connectivity of Check Point software to Check Point online update services that use SHA-256 based certificates, a hotfix is required. Check Point highly recommends to install this hotfix to maintain the aforementioned update services functionality.”. In other words – if you’re not on R77.30, you should install the hotfix on all of your firewalls and management servers before November.

Shockingly, though, a quick query of indeni Insight’s database shows that only 17.9% of Check Point firewalls are either running R77.30 or the required hotfix. So the vast majority of Check Point firewalls out there are not ready for November.

So, what should you do? This is what we recommend:

Read the SK to get the complete picture.
Map out the devices that you own, the versions of software they are running and which of them have the hotfix installed.Users of indeni can generate an inventory report (Reporting -> Inventory Report in the web dashboard) and review the Hotfixes Installed sheet. For each device, you should have either a hotfix containing “R77_30” installed or one containing the text “SHA256”. The screenshot to the right shows an example of what you should look for. In 5.3, you will also receive an alert for each device that still needs to be upgraded.
Plan the installation of the hotfix throughout your environment. According to the SK, this should not result in any downtime.

Time to get cracking!

Get in touch

We’re the DDI provider you’ve been looking for.
Drop us a line and let’s talk.

Unlock $120K+ in network ROI

Check Point Users: You Are Not Ready for June 5th, 2016

Related content

BlueCat moves agentic AI from insight to action with new AI integrations

BlueCat appoints Jeff McCullough as Vice President, Worldwide Channel and Alliance

BlueCat introduces BlueCat Horizon, a SaaS-first Intelligent NetOps platform for cross-domain network operations

Fewer than half of enterprises are fully successful with network observability tools