How to Minimize Security Risks and Optimize Resources with CrowdSec and Check Point

In our recent webinar, we joined forces with Check Point to showcase the ease of integration of our blocklists into Check Point’s powerful firewall. 

By combining the two, companies big and small can minimize the risk of cyber intrusions, especially during high-profile events like the Paris 2024 Olympics, during which we offered a free blocklist to help protect Frech businesses against malicious IPs hyper-targeting Frech assets. 

In this article, we will recap the highlights of the webinar, explain in-depth the integration between Check Point and CrowdSec as well as dive into our Blocklist as a Service feature and how you can minimize your cybersecurity risks and lighten your firewall’s load. 

Blocklist as a Service: Check Point and CrowdSec

With the new Blocklist as a Service feature we recently implemented on the CrowdSec Console, CrowdSec Blocklists can be easily integrated into a number of different tools to provide enhanced protection in only a few clicks. One of the first companies we collaborated with to make the Blocklist as a Service available was Check Point. 

Check Point’s firewall ecosystem, known for its scalability and flexibility, supports various configurations to meet the growing needs of organizations. By integrating our community-driven blocklists that collect attack signals from real-world infrastructures to Check Point’s powerful firewalls, companies can reduce the risk of intrusions and, at the same time, reduce the firewall’s load. 

The way the Blocklist as a Service works is that it allows you to send IP lists in the format of your hardware or software. With Check Point, you can send the list as an Indicator of Compromise (IoC) feed to their firewall. You can easily do this from the CrowdSec Console, by following the instructions here. 

You also have the option to add a CrowdSec Blocklist to the Check Point portal by creating an API key within the CrowdSec Console. Within Check Point, you can combine as many blocklists as you wish and since CrowdSec has a diverse list of blocklists pertaining to specific industries, behaviors, and countries, you are sure to block a wide variety of malicious IPs as they move upstream and before they can cause damage to your infrastructure. 

Check Point’s firewall ecosystem: An overview

Check Point has been in the cybersecurity business for over 30 years and provides a wide range of firewalls that can be used from small office branches to large data centers. Thanks to their upgradable framework and vast ecosystem, they can keep pace with developing threats and continue to protect their comprehensive portfolio of clients. 

At its core, Check Point’s Next-Generation Firewalls (NGFW) offer robust features such as intrusion prevention, threat intelligence, advanced malware protection, and application control. 

The ecosystem integrates with cloud platforms, data centers, and endpoints, providing unified management and real-time threat detection through its ThreatCloud intelligence network. This seamless integration and centralized management allow organizations to maintain a strong security posture across all layers of their IT infrastructure.

Use case: How IoC feeds reduce firewall load

The integration of the CrowdSec Blocklists adds an extra layer of security and also fills in gaps between the security perimeters that Check Point covers. However, protection is not the only purpose this integration serves.

By adding CrowdSec’s IoC feeds to the Check Point firewalls, you are also able to reduce the firewall’s load by pre-filtering malicious IPs before they reach higher-level firewall engines. For instance, filtering through IoC feeds allows firewalls to dedicate more resources to critical tasks like SSL decryption and advanced Intrusion Prevention System (IPS) rules.

A good use case is the 2024 Paris Olympic and Paralympic Games, a high-profile event where the sheer volume of attacks before and during the games, can overwhelm traditional defenses. The 2024 Paris Olympic blocklist, offered for free during the summer by CrowdSec, contains thousands of aggressive IPs identified as targeting French interests that have been particularly active for the last 30 days. 

Thanks to the 80% reduction in alert volume, injecting this blocklist into your Check Point firewall either via the CrowdSec Console or creating an API key and adding it via the Check Point portal can save up to 2 FTE worth of time. 

Tailoring blocklists for specific threats

There are many blocklists out there and quite a few you can integrate into your Check Point firewall. So, what makes CrowdSec’s blocklists so unique? We are glad you asked! Besides leveraging the power of the crowd to proactively block attackers, reduce traffic, and a very well-made consensus system that guarantees 0% false positives and poisoning, you can also tailor the blocklists to specific needs. 

One of CrowdSec’s strengths is its ability to customize blocklists. Organizations can choose blocklists based on industry, behavior, or even geography. For example, CrowdSec offers blocklists specifically targeting sectors like healthcare, finance, and ecommerce. Moreover, companies can create their own blocklists by integrating third-party feeds or using their internal alerting systems.

Collaboration for enhanced security

As large-scale events like the Olympics put infrastructures in the spotlight, integrating CrowdSec and Check Point provides a strong solution to protect against cyber threats. 

With CrowdSec’s unique, crowd-powered blocklists and Check Point’s scalable firewall architecture, organizations can effectively mitigate the risk of intrusion while optimizing network performance. Protecting your systems and saving resources only takes a matter of minutes — really!

Integrate the CrowdSec Blocklist into Check Point’s firewall in only a few clicks through the CrowdSec Console or by creating an API key.