Workspace Security
Workspace Security
Workspace Security tests how Check Point protects the user's working environment: endpoint, browser, email and collaboration, mobile, and remote access. The unifying idea is zero trust - every session is authenticated, device posture is checked, and access is limited to what the user needs - rather than a flat VPN into a network segment.
Controls and where they sit
- Harmony Endpoint provides EPP and EDR on the device: anti-malware, behavioral guard, threat emulation, disk encryption, DLP, and forensic data for investigation.
- Harmony Email & Collaboration integrates through APIs with the mail provider. It does not require changing MX records, which is a frequent exam trap.
- Harmony Browse protects web sessions inside the browser, isolating risky pages and blocking credential phishing without hairpinning traffic through a network proxy.
- Harmony SASE delivers ZTNA, secure web gateway, CASB, and DLP from the cloud. ZTNA publishes individual applications, not whole subnets.
- Policy is applied by user group and computer group. Exclusions are scoped to specific blades and paths, and a broad exclusion quietly disables protection everywhere it applies.
Worked example
Users report that a line-of-business application crashes when endpoint protection is enabled. An administrator adds a folder exclusion for the application directory. Reasoning: this disables the relevant blade for everything in that folder, including malware dropped there later. A better fix scopes the exclusion to the signed executable or vendor process, keeps the rest of the folder protected, and records the exception with an expiry date. The exam rewards the narrow, least-privilege exclusion, not the fastest one.
Traps
- Assuming email security needs an MX change; API-based deployment does not.
- Treating zero trust as "VPN with MFA"; ZTNA is per-application and posture-aware.
- Writing posture checks that fail open when the agent is missing.
- Forgetting that an endpoint without the agent is not covered by endpoint policy regardless of what the console shows.
- Confusing DLP with encryption: DLP detects and blocks data movement; encryption protects data at rest.