Using The Reputation Service To Allow Or Block Applications; Pre-Requisites For Using The Reputation Service - Check Point HARMONY R81 Administration Manual

Using the Reputation Service to Allow or Block
Applications
The Check Point Reputation Service is an online service that gathers information about
applications and classifies them as approved or not approved. The classifications are based
on the recommendations of Check Point security experts and the hash value of the signed
certificate of the application.
The Endpoint Security client uses the recommendation of the Reputation Service for the
application, together with the permission setting for the application in the Application Control
policy, to decide whether to allow or block the application.
For example, if an application is configured in the Application Control Policy as Unidentified
(Allow), and the Reputation Service recommendation for the application is Not Approved, the
application is blocked. However, if the administrator explicitly configures the Application
Control policy to Allow or Block the application, the policy setting overrides the
recommendation of the Reputation Service.
The Endpoint Security client allows or blocks applications according to the following logic:
Reputation Service
recommendation for the
application
Approved
Approved
Not Approved
Not Approved

Pre-Requisites for Using the Reputation Service

n The Endpoint Security Management Server must have Internet access (on ports 80 and
443) to connect to the Check Point Reputation Service Server. Make sure that this traffic
is allowed.
n We recommend that you add the Reputation Service Server to your Trusted Zone. See
"Changing the Access Zones Policy" on page 397

Using the Reputation Service to Allow or Block Applications

Application Control Policy
setting for the application
n (Unidentified) Allow
n (Unidentified) Block
n Allow
n Block
n (Unidentified) Allow
n (Unidentified) Block
n Block
n Allow
R81 Harmony Endpoint Server Administration Guide | 381
Decision by the
Endpoint Security
Client
Allow
Block
Block
Allow
.