Check Point Application Control Reviews

We have main and branch offices as well as on-premise and cloud data centers. Using Application Control we control the necessary applications instead of creating one or several rules for one application. 

With the AppWiki from Check Point, we can even show users that don't have a log in what applications there are and even see the risks involved at a single glance.

If you use Microsoft services, there are a lot of different applications that the firewall can differentiate and this shows also in the logs.

Using Application Control instead of normal rules and ports helps with ever-changing product versions. In the past, each version could add/remove certain ports which have to be added or removed by the administrators. With automatically updated applications, you don't have to do that continuously.

Enabling Application Control is unbelievably easy as once it is enabled you can use all relevant applications within the rule base.

Seeing applications within the logs also makes troubleshooting easier as you can see if the firewall recognizes the relevant application.

Check Point Application Control offers a wide selection of applications, and even within those, you can configure uploads, downloads, et cetera, on a very granular level. That way, users can use a single application for viewing data but are unable to upload potentially unwanted files. Basic functionality can be provided without decreasing security. In addition, using Check Point Logs we can also see what is allowed/blocked and can act accordingly.

Using APCL within the normal rule base also makes administration easier.

If you want to use Application Control over your whole environment you have to license it for all gateways. Otherwise, you can only work with a subset of it. Therefore, pricing can be quite an issue.

We saw that sometimes APCL stops working and can cause an impact on the rest of the rule base. Therefore, it's advisable to check that the gateway can always update itself with the newest applications.

Sometimes applications are not recognized. This may be due to HTTPS Inspection settings. It's also advisable to fully inspect traffic.

I've used the solution for over two years.

Application and URL filtering is the perfect combination to block unwanted application and web browsing traffic based on the defined policy.

Customers who don't have a dedicated proxy can utilize Check Point's Next Generation Firewall as an Application Control.

It allows users to define policies based on source IP, user role, or group, which can easily identify traffic flow with SAML. You can allow or block traffic coming or going out to the internet for specific applications or websites.

Most organizations take advantage of application control, which provides the most efficient and accurate results to block or allow application traffic.

No organization requires entire access for an application running as that would cause more risk, which is not desirable. If we want to allow certain required applications, with Check Point, application control is possible.

For customers that have database servers and public-facing servers and want to provide access to specific services, Check Point is perfect.

With application control and URL filtering, it becomes possible to block/allow applications and sub-applications the maximum flexibility to allow for policy-based access roles. The solution offers user notifications for blocked access, time-defined policies, and bulk categorization of malicious applications.

With Check Point Application Control, it is possible to mitigate unwanted application traffic even it detects items, and allows traffic for specific ports which can be required to run the specific application successfully while blocking traffic from all remaining ports.

We get a Smart Event Report which clearly shows us how many applications are running under the Check Point Gateway and which applications require more security rules while revealing vulnerabilities.

Customization rules for custom applications help to define rules.

The application layer is the most usable feature Check Point provides to categorize and distribute the different sets of rules which work in a top-down lookup approach. This allows users to define policies separately within that particulate layer.

By default, an implicitly cleanup rule exists.

The product offers easy-to-install policies and makes it simple to troubleshoot application-related traffic.

The solution is integrated with an app wiki to provide a large application database.

Smart Event generates reports which are very useful in order to identify non-required applications running into the environment.

The working principle of Check Point Application Control is far different from all other vendors in the market. It basically works in parallel with security rules. Every time packet must go from policy lookup into security rules. It sometimes leads to a troubleshooting phase for which we can create application traffic.

SD-WAN functionality can be added.

Direct API integration for customized application features can be added.

Load balancer functionality for application traffic might be a better option.

There is no completely stable solution. Even if you consider a competitor solution, you will face some issues from time to time.

The scalability is based on the device throughput.

There is dedicated TAC support for the specific blade in Check Point, which provides for a better resolution.

We did a direct migration from Sophos/Cisco FTD to Check Point. This has been done for many customers and usually leads to changing application control.

The initial setup is straightforward in terms of the policy configuration and licensing.

We are the vendor. We can assist in implementations.

The setup is very straightforward and the licensing works based on a subscription model.

We did look at dedicated proxy servers.

Before using this solution, I needed to have other network components that would allow me to block or restrict access to unauthorized sites, which generated a very high cost in terms of licensing and maintenance. Now, I can control authorized and unauthorized access to my end-users, and I can control bandwidth and assign a defined bandwidth to guarantee the operation of my company. 

With this solution, I was able to establish and guarantee the security of my end-users using the categories and definitions within the solution. I'm able to easily identify high-risk sites, as well as sites not allowed for explicit content.

In the beginning, I did not have control of the content that my users had access to, which put the integrity of my company at risk. With this solution, I was able to create explicit policies that would adhere to the rules that we established for access to applications. 

Previously, I had 2 appliances from another brand to control the traffic of applications and to control bandwidth. It is a very simple product to administer with amazing potential endowed within a large database of applications and is constantly updated.

The automatic updates of new applications and signatures guarantee protection at all times without the need to apply a change manually. This has been largely beneficial to my organization and only on a couple of occasions have I had a problem with legacy applications being applied to a filter incorrectly. We've solved this by documenting them in the Check Point portal to ensure they are not listed as a malicious application or IP. There is a large database of applications that have been incorporated together with the traffic control tool assigning a defined bandwidth for certain applications.

It's important that there is the option to validate the policies before applying them since it is very annoying and causes a waste of time to apply a new policy or rule and afterward receive an error that the policy has failed. 

It is important that, if you are being notified of the modifications in the automatic policies that were updated, it's clear in terms of the content that is included as well as the applications that have been modified for being malicious or not. 

Without a doubt, these would be contributions that would greatly benefit the solution's operation within my company.

I've worked with the solution for 5 years.

In some equipment, the scaling is very good, however, it depends on the equipment that is purchased and if there is correct sizing.

Yes, I made the change because I tried a demo and it seemed like a great product.

It is a very safe and stable product.

The licensing is very good. We always rely on an authorized dealer to ensure proper operation and sizing.

Yes, I evaluated Cisco, Palo Alto, and Fortinet.

Not at this time. 

The Check Point Application Control blade provides application security and identity control for our organization. It gives us very easy to create policies based on users and groups. We use Critical Risk and Anonymizers, P2P file sharing, Spyware, and Remote admin categories. We use Application Control in two ways, separate rule base and with access policy as well. My all over experience is good.  

With Check Point Application Control we can say we improved our legacy and have made them more secure. Now we are able to allow specific applications on respective service and we are allowed those respective services only. 

With Application Control we have visibility into who is accessing which application but our pain area is still with HTTPS inspection. 

Overall, Application Control is a very good blade and it is very helpful in our complex environment. We can restrict our site to site rule as well.

The Check Point Application control database contains each and every application and category and each of the applications and categories describe the additional category and also a risk level. The database updates regularly. It gives us the updated and latest lists of applications that are widely used. We can filter a search based on risk level, risk level 5 to see all applications with that risk level. We can also see the description of the risk level with the lag line. 

Most of the business applications stopped working, we don't know why and we have already escalated to the top level but we still haven't gotten any corrective action on this. They always take logs but after that, there is no resolution. They need to improve this, this will help us a lot. We have not blocked anything on a rule base we have enabled HTTPS on a monitoring mode but still, we are facing issues, and if we add an unknown category on that respective rule only then does it start working.

I have been using Check Point for four years. 

Stability is good. 

Support is genuinely not good on Application Control.

The initial setup was straightforward.

We initially implemented it with a vendor. 

We have seen ROI.

They have to improve more on the Application Control blade.

This software monitors the performance of applications across the company. It provides comprehensive security for all the tools contributing to the company's growth. 

Check Point Application Control has created reliable data management policies that guide employees on how to interact effectively with applications. The software assigns each sector the most suitable working tools to easily implement projects and tasks. 

We were able to customize it and make efficient configurations with data models.

This platform has fully secured our applications with very powerful firewall security upgrades. 

It has taught employees how to protect their work tools from external security threats. The system has a secure database that keeps information on applications in a secure environment. 

It interconnects easily any network platform that faces challenges restoring normalcy. It updates applications for compliance. It unlocks hidden security barriers that affect workflows.

All the features collaborate in the management of application security. Granular control monitors the models that create a given application. 

It tracks down the performance of all the given tools in the system to ensure there is reliable performance. 

Application groupings simplify the work of monitoring operations and checking the security situation of the entire production chain. Next-Generation Firewalls identify any malware attacks that could harm data and slow down operations. 

The Network Security monitoring system has enhanced the safety of the company's cloud-based servers.

The learning curve for new users is challenging since the integrated data models are complicated. 

The system slows down when the company has a lot of applications. 

New versions that are upgraded rarely come with new market updates. 

The cost and deployment capacity is based on the size of the company. The overall performance is excellent when the system administrators from the company work closely with the vendor-customer support team. 

It has enhanced a secure work environment and enabled employees to focus on more productive tasks.

I've used the solution for 12 months.

It is stable and highly productive.

It is highly scalable with perfect performance.

The customer support staff is dedicated to their work, and I will always cherish their great support.

Positive

I have no experience with a similar solution.

We did not experience complications during the setup process.

It was implemented through the vendor, and they provided the required support and guidelines.

The ROI has been positive with increased performance.

The cost is good and flexible for any organization.

We settled on this product the first time.

I highly recommend this software for comprehensive application security enhancement.

The Check Point Application Control solution is used by us on two firewall clusters. It is used both on the inside and on the outside.

Analyzing internal traffic helps us to understand which applications are used within our network. It does more than simply allowing or blocking traffic. It provides a report on how much these applications consume on the network and where they are used.

On the foreign side, we only allow applications considered safe and we always use the report to identify external attacks or improper use from the inside out.

Check Point Application Control application I would define it as oxygen: you notice it when it is missing and I say this because we now think it is natural to have this module incorporated in a firewall.

In the beginning, without this module, we were in the dark about everything. We were forced to open internal or external traffic by trusting (sorry for the nonsense) who was doing the traffic: unthinkable today!

Now we know who does what and can give specific permissions based on the user or the group to which the user belongs. The same user can have maximum permits on the professional side but be protected himself from ending up on sites that are improper for his work activity, such as porn sites.

The most important feature, in my opinion, regarding Check Point Application Control is the granularity and the great variety of applications and sub-applications recognized.

Consider that I can make multiple rules for the same user or group of users by detailing what it can do perfectly. The applications are not trivially listed but well-specified. To give an example: the Facebook application is not simple but its features are listed so that I can allow the use of Facebook but not the uploading of a file.

It is hard to say what has to be improved in Check Point Application Control.

Occasionally, we have to identify an application that is not registered. I would like to have a periodic update of the applications, perhaps based on a predefined calendar.

We would like to have the ability to submit new applications for registration, as well as request the recategorization of URLs.

We have been using Check Point Application Control for twenty years.

I have not found any particular malfunctions so I can say that it is well implemented.

Through a firewall cluster, I can increase the power and reliability of the system, and avoid buying a superior model.

Customer service is very competent.

We did not use another similar solution prior to this one.

The initial setup was straightforward.

Setup is made easy by using logs. As a first rule, I put the blocking of applications that come to mind, then a rule of allowed applications specifying all applications. By looking at the logs, I will be able to refine the rule by populating that of blocked applications and creating one of the allowed applications.

For maximum security (but maximum limitation), I can put at the end a rule that blocks everything but will block both applications not previously specified and those not recognized. This rule requires having a team that looks at the logs a lot, otherwise, it is better to put it on permission and analyze it periodically.

We implemented it through a team that lived up to the solution.

The blade has its cost but you can take advantage of the license package to pay less for it.

We did not evaluate other options.

It does not require excessive resources but if you intend to use it massively, do not underestimate the size of the firewall.

We use Check Point in our internal network, as well as on the perimeter & we have used the Application control-blade on the internal firewall. All of our user traffic will be terminated at the internal firewall, hence we have done primary filtering of traffic on the internal firewall only.

Basically, on the internal firewall, we are blocking all social networking sites, remote meeting applications, adult content, & torrent applications. This restriction helps us to save our bandwidth as well to ensure that users follow & maintain work ethics at the office premises.

Application control blades help us in two ways. The first is to allow specific applications, where earlier we have to find out all of the URLs needed for each application & then allow them one by one. Now, we now just find the application. The second way is to restrict the user from browsing unwanted websites.

Together, these improved security & help to maintain discipline & focus at work.

The application control-blade also helps us by providing visibility. We have an overview of application traffic & depending upon the content, we can decide to allow or deny the application.

Check Point has its own application database where more than 7,300 applications are known. I am able to see them using the smart console, along with details for each one. Each and every application has an accompanying category, some knowledge about the application, the protocol it uses, & the risk factor associate with it.

Implementing application control is very simple & it is designed in such a way that we can introduce it with access policy. Also, to reduce complexity, we can create an altogether different layer.

This product logs & monitors event traffic for each application, giving us better visibility. Updating the application database is very easy; we just have to schedule the update & the device will automatically fetch it on a regular schedule, such as every two hours.

We expect applications to be updated regularly.

I have been using Check Point Application Control for more than three years.

This is one of the stable modules in Check Point.

Scalability for application control in the Check Point gateways is good & does not take need much processing power.  

Check Point TAC is always helpful, although particularly for application control, we have not yet raised any tickets. For the help that they have given us with other products, I appreciate the effort from the support team, as they always help us when we ask. 

Prior to this, we used FortiGate but the Check Point database is far better.

The initial setup is very simple.

We completed the implementation in-house.

I think application control has become a basic feature and it should be enabled automatically, without having to purchase a separate license for it. Alternatively, it should be available at a minimal cost.

We have not evaluated any other options.

The only thing we expect from a Check Point is to regularly update their database with the new applications. Other than this, specific to the application control-blade, I have not seen any issues or problems.

Our primary use case of Check Point Application Control is to filter which application categories we want to allow our organization members to have access to so that they are secured. For example, we don't allow access to malicious applications and some categories that could be threats. We only allow organization members to access secure applications and applications that are aligned with the company's strategy. 

It also enables us to save internet bandwidth by filtering applications that are not work-related.

Check Point enables us to save internet bandwidth. The administration offers good guidance. We don't want the employees to access social networking on work computers because it will distract them from their jobs, so we can block that. It also helps us to implement changes very quickly and to get people to be more focused on the job. 

We can block employees from downloading illegal content that would harm the company image with our IPS. If an employee downloads torrents with movies that should be paid for,  they can detect that it's our company's IP. We could be fined and it could be good damage to the company image. So we block those kinds of applications.

The features are very granular. You can block Facebook Chat but allow Facebook itself. The big database and the easy configuration are also valuable features. 

I think Check Point Application Control is one of Check Point's most complete solutions. It has had a lot of years for improvement. I don't see anything that we need to be improved. It does everything that we would need. It always applies new applications. It does what we need it to do. We don't need to select a specific application if we don't need it, it can be selected by category. The solution is very complete. 

I have been using Check Point Application Control for eight years. 

The solution is stable. We didn't have any specific issues. 

It's scalable in a way that you can use the same application and filter objects on all the gateways that you have under managers. You can define one profile applied to all firewalls.

There are around 1,000 users in our company who are affected by Application Control. 

Four network security engineers are responsible for the maintenance. 

We deployed only on the perimeter firewalls. If we need to add some more perimeter firewalls, we will deploy to that as well.

We specifically chose Check Point because we needed to filter internet access. It was already in place in some firewalls when I came to my company. My colleague implemented it on some other firewalls. It was already placed in one or two firewalls. 

The initial setup was straightforward. We generally use the blacklist method for Application Control. That is where you select which application categories and specific applications you don't want to be accessed and then you allow everything else. This method is easier than what we did in the past where we tried to do it the other way. We would only allow specific applications for a specific project and then deny everything else. But then there was always something missing because the machine would need to update and we would need to have a new application. There was always something being blocked that shouldn't. 

It took us about one week to define the strategy and then two to go through the list of categories that were available to define which we would deny. We would also discuss with the GRC team and get guidance from the administration. 

Our ROI Speaker is that it adds another security measure that doesn't allow employees to access websites and applications that can harm our company, and by keeping the company's IPS reputation clean. It also blocks categories like social networking and gambling. Those kinds of categories also increase productivity and decrease internet link usage for things that don't interest the business.

Pricing is in line with the competition. Licensing is not complicated. The license application is straightforward and it functions well. There are no additional costs that I'm aware of. 

My advice would be to deploy Application Control with a blacklist approach. In which you select which application categories to block and accept others. Otherwise, from our experience, it's a mess. It's much more easy and efficient than doing the whitelist approach, in which you would select what you would allow and block off the rest. It can forget to add a category or an application that is needed and so you will always need to be adding them on a request basis.

The whitelisting approach should only be on very specific applications. In which only a server should access a certain application and nothing else. If you miss something, you will have to always be investigating why it doesn't have access or why an application is not working. 

We tried to do a whitelist approach on a specific environment, but we gave up because it was starting to get to be a bit messy. Some servers only need it to go to the internet to do some updates on some applications. They shouldn't access any other categories. That was always something that was not working because some application was categorized as technology and it was also categorized as, for example, social networking.

The biggest lesson is that it's very important to have Application Control on the company's internet access. A previous company I worked at, got a court letter saying that our IP downloaded two movies from torrents. The company got a final warning that if our IP would be caught downloading illegal stuff again we would have problems and so the company implemented Application Control. It's very important for the company's IP reputation and also for employees to be focused on their job. You can block malicious applications which gives you another level of protection and also reduces internet link usage.

I would rate Check Point Application Control a ten out of ten.