Check Point Capsule

What do you like best?

CheckPoint provides enrollment based on Username. Hence it enhanced Security as the only user who needs to have access to corporate Data via Mobile devices will enroll. Post integrating NGFW with AD, the admin can create a Token and share the same via email.

Each device which User want to enroll has to be register separately via individual Token

There is no additional Infra required for the setup as same can be enabled by enabling module post getting license from Checkpoint on same NGFW

Centralize management as it Uses the same console, which is Used for NGFW (Smart Console)

It provides capabilities to published corporate information to enrolled mobile devices without needing to published over the internet in a secure manner

It provides visibility of share data over BYOD, and admin has control over who can access which data and even block the access in case someone tries to enroll via a compromised/rooted/jailbroken device.

It provides the capability of remote wipe in case devices is lost/stolen or if users leave the organization

Create a separate workspace on BYOD, and the admin can write DLP policy by disabling sharing between corporate and personal storage to prevent data leakage issue

App or Web or file folder publishing Securely, for example,

if the developer wants to test app functionality on a mobile device over the Internet. The same can be published via Capsule only for a developer using SDK or App wrapping method, and the same will be available for a developer for testing without same getting published over the internet for the rest of the world

Single Sing On for Corporate application/data

What do you dislike?

If the count of multiple devices or enrolled user is more, it's complicated reporting in term of access, which has been provisioned to user

Access is based on Username and if user want to change device or have mulitple which need to be enrolled separate token has to be generated for each device which complicates the enrollment process

Shared devices access in case single devices need to provide multiple users where each user has different access. The same device need to enroll each time with different user

Recommendations to others considering the product:

The organization should be clear on the requirements. If it is only to publish web apps, URLs, email, or shared drives, withing spending much on Infra cost and with organization having Checkpoint NGFW with a single management checkpoint is the solution

What problems are you solving with the product? What benefits have you realized?

Providing access to corporate data on BYOD devices securely without having a data leakage issue

Providing access only to User who are allowed to have access along with access control in term of data available to each user

Restricting access based on multiple criteria such as rooted/jailbroken/compromised/version

Corporate data always on on and handy on BYOD