Check Point made an acquisition announcement today. There is not much information, but I have been able to find the following:
- The company was formed in 2017
- The company was Israeli-based
- The acquisition was for less than $10 million
I also found this:
ForceNock developed a fully autonomous web application security solution that replaces existing WAF, API, and bot mitigation solutions. The system frees security teams from managing endless configurations and rules while maintaining a high level of security.
In addition to the fully autonomous negative security, fully automated or semi-automated positive security is provided in tandem with OWASP top 10, API logic abuse, layer 7 DoS, and protection from a variety of other attacks.
The ForceNock solution is currently offered as a virtual appliance, AMI, or Docker for private cloud deployment as a reverse proxy or plugin for Nginx/Apache.
There is really not a whole lot of information out there on Forcenock at the moment. I do like seeing that it has a solution for Docker and NGINX: Check Point has so far been missing from the whole Container space.
So Forcenock has WAF functionality that will address the OWASP Top 10. Check Point used to cover the whole OWASP Top Ten (XSS, Command Injection, LDAP Injection, SQL Injection, etc) with Web Intelligence.
Then the “Top Tens” changed a little bit to include protections that would be set within the application, and became somewhat difficult for a firewall to address.
We still the remnants of “Web Intelligence” except they have been renamed as “Core” protections in R80.20.
Easy2Comply was an acquisition back in 2011 that went to become the Compliance Blade. Given the relative newness of Forcenock, and the estimated value of the acquisition (low), I think this will be more of a Easy2Comply-type of scenario.
I am going to take a guess that Forcenock might end up as a replacement/refresh for the “Core” protections. Maybe it’s also a baby-step towards securing containers? Will they be one of Dorit’s slides, or maybe tucked away in a 20 minute tech session? It will be interesting to see what they say at CPX.