Stronger Endpoint Security Starts with a Hardware-Based Foundation
Total Page:16
File Type:pdf, Size:1020Kb
White Paper 4th Generation Intel® Core™ Processors and Intel® Atom™ Processors Intel and Windows 8.1* Mobility Stronger Endpoint Security Starts with a Hardware-Based Foundation Whether you use traditional management or mobile management solutions, keep your enterprise safer with devices built on a framework of hardware-assisted security Mobile Devices Need Stronger Protections When it comes to convenience and access in the enterprise, this is a golden age. Users can access corporate resources and data from their smartphones, tablets, or PCs from almost anywhere at any time. Of course, what’s convenient and productive for your users can be a security and management headache for your IT administrators as they strive to take advantage of increased mobility and the bring-your-own-device (BYOD) trend while securing corporate data. The personal nature and associated usage patterns of mobile devices make them prime targets for attacks. Users are not known for their security awareness. They install all sorts of apps on their mobile devices without regard for the security of those apps. Users allow apps to have all the device permissions the apps ask for even when the permissions are overreaching. Mobile devices are often shared between family members with little oversight over how they’re used or what websites and data they access. The devices also might frequent wireless networks that have dubious levels of security. Users then use these devices to access both personal and corporate data. These usage patterns put mobile devices and their users at higher risk from identity theft, malware, and other stealthy threats that can infiltrate systems at deeper levels to steal data or even take control of a device. Windows 8.1* now makes mobile management of PCs possible by adding more granularity for control of non-domain-joined mobile devices and support for mobile device management (MDM) products. By supporting the Open Mobile Alliance Device Management (OMA DM) API, Windows 8.1 enables you to manage devices through a low-overhead agent without needing to deploy a full management client on each device. But MDM products don’t offer the same level of control as traditional domain-joined management solutions. To strengthen endpoint security, you need a solution that builds from the silicon up to better ensure the integrity of the system even before the operating system starts. By using tablets, Ultrabook™ devices, 2 in 1 devices, and laptops powered by 4th generation Intel® Core™ processors and Intel® Atom™ processors running Windows 8.1, you can complement your MDM solution with strong, hardware-assisted security and with more comprehensive management, speed, and efficiency.1 Stronger Endpoint Security Starts with a Hardware-Based Foundation Table of Contents Strong Security Starts before the Each time the device is started, these Operating System combined technologies help ensure Mobile Devices Need that the deepest levels of the system Hardware-assisted security adds layers Stronger Protections . 1 are not tampered with. But hardware- of protection that stay with the device enhanced security doesn’t end with the Strong Security Starts before regardless of how it is used or managed. boot process. Intel Platform Protection the Operating System . 2 Even before the operating system starts, Technology with Intel® OS Guard helps deeper layers of security are working Block Stealthy Malware . 2 protect the deepest levels of your to help prevent stealth malware, like a Provide Safer Authentication . 3 system, even if an application has been rootkit, from injecting itself and taking compromised.2 This unique Intel feature Secure Your Company’s Data . 3 over a system. For example, during the helps prevent hackers from remotely initial Windows 8.1 boot process, Intel® Strengthen Encryption taking over a user’s PC by preventing Platform Protection Technology with with True Random Numbers . 4 malicious code in compromised application BIOS Guard and Boot Guard helps prevent Meet the Mobile Device memory from launching low-level, privilege unauthorized software and malware from Security Challenge . 5 escalation attacks. taking over boot blocks that are critical to a system’s function.1 Unified Extensible Block Stealthy Malware Firmware Interface (UEFI) Secure Boot continues early protections by ensuring Once stealthy malware infects the system, only a properly signed operating system it stays invisible to antivirus software. loader is used during startup. That gives the threat an opportunity to take control of the system, steal Windows 8.1 Trusted Boot provides confidential information, and spread to additional startup protections by using the other systems. Mobile device users need UEFI root of trust to ensure that the rest run-time protections to help block stealthy of the boot components are secure and threats—malware that can infect deeper have integrity. At the same time, Windows levels of the system and go undetected by 8.1 Measured Boot takes measurements software-only solutions. of each component—from firmware up through the boot start drivers and even The strongest protection from malware anti-malware drivers—and securely comes from solutions that don’t rely on locks away the measurements in a knowledge of existing threats. By pairing built-in protections from Windows 8.1 2 million trusted platform module (TPM), such as Intel® Platform Trust Technology. The devices powered by Intel Core processors Stealthy rootkit malware samples measurements collected by Measured with McAfee Deep Defender* software, documented by McAfee Labs in 2012, Boot can be securely accessed from Intel you can detect and block advanced, hidden compared to 42 samples in 2007.3 Platform Trust Technology by third-party attacks in real time before they cause security software in order to compare the damage. McAfee Deep Defender relies on current state of the system against the McAfee DeepSAFE* technology, a solution known-good state established by Secure jointly developed by Intel and McAfee that Boot. By establishing and verifying a delivers real-time, kernel-level monitoring trusted state, you can better ensure the of memory. This unique connection to integrity of the system and help identify hardware with behavioral-based detection and block malware before it takes root. makes McAfee Deep Defender more 2 Stronger Endpoint Security Starts with a Hardware-Based Foundation effective than software-based solutions. or fumble with a physical token, while the wrong hands. With mobile devices In fact, in testing against top competitors still benefiting from the stronger security off the company network and outside of by AV-TEST labs, McAfee Deep Defender offered by two-factor authentication. domain control, this can be a challenging was the only product to detect 100 For devices powered by Intel Atom proposition; but several Intel hardware- percent of stealthy rootkits.4 processors or Intel Core processors with assisted technologies can help you keep Intel® vPro™ technology,7 Intel IPT with PKI your data away from prying eyes. With strong, proactive protections from offers an alternative to physical smart Intel OS Guard and McAfee Deep Defender, cards that is easier to deploy and less you can stop more kernel-level attacks expensive. Intel IPT with PKI has built- before they have a chance to propagate in hardware capabilities to store digital and threaten mobile devices based on Intel certificates in firmware for secure VPN processors, even when the devices are or Secure Sockets Layer (SSL) web site 17, 317,18 4 non-domain-joined or are inaccessible from authentication, to authenticate a user and your corporate network. Identities exposed in 447 reported a server to each other, and to encrypt and breaches in 2012.6 digitally sign e-mail and documents. Even if Provide Safer Authentication you already have a PKI implementation in Providing secure access to resources has your organization, Intel IPT with PKI could Encryption is one of the best ways to always been a challenge for organizations. save you money by eliminating the need keep your data safer, but organizations That challenge has grown recently, due to purchase and support traditional smart are often reluctant to widely deploy to the expanding landscape of mobile cards or other token storage options. In encryption because of the overhead it devices, applications, and busy employees addition, on devices powered by Intel entails. Intel helps you remove the barriers on the go. To better protect your assets Core processors, Intel IPT with PKI can be to deployment with Intel® Advanced and users, you need to provide something used with Protected Transaction Display Encryption Standard New Instructions stronger than a simple user name and (PTD) technology, which lets you create (Intel® AES-NI),8 a cryptographic password scheme for authentication and secure PIN pads to protect passwords and instruction set that accelerates AES data VPN access. With Intel® Identity Protection numeric key entries from screen-scraping encryption and decryption on devices Technology (Intel® IPT),5 Intel provides a and key-logging malware. powered by Intel Core processors and hardware root of trust that can be used by Intel Atom processors. Because of the multi-factor authentication solutions on Secure Your Company’s Data enhanced cryptographic performance of devices powered by Intel Core processors Data is your company’s most valuable Intel AES-NI, IT can reap the benefits of and Intel Atom processors. asset. From customer information to encryption