There are two primary
(and related) security concerns relating to communicating with the CheckPoint
License Server:
- Point to point security
of the information -
It is highly recommended that you use SSL to secure any and
all communication with the CheckPoint License Server. This
ensures security of the information passed between the server and the
caller (some other part of your back end). In this
way, you can be assured that even if packets were intercepted by an attacker
- they would be unable to use the information to directly access the CheckPoint
License Server.
Keep in mind that proxy servers generally can not act as a proxy for
HTTPS (SSL) communication. HTTPS requires a secure
handshake from point-to-point to enable its secure communications. A
proxy server can not be in between the two participants (client and server)
of an SSL communication. Most enterprises that use proxy servers allow
direct outbound SSL communication for the workstations (default port 443)
to allow SSL communication to work. If you are
deploying your CheckPoint Server to be accessible via HTTPS only, be sure
to take this into account when managing proxy server information for your
clients.
- Brute force attacks
- It is highly recommended that you configure an upstream router or fire
wall from your CheckPoint License Server to not forward requests from
a specific requester if a large number of them come in from the same requester
over a short period of time. This allows you to
effectively block programmatic authentication attacks or denial of service
attacks on either of the CheckPoint interfaces. Most production quality
fire-wall software has this feature.
Note:
The GameShield CheckPoint™ License Server only comes with the Server
Edition of the GameShield System.