Hardware: The Foundation for PC Security

Software security requires a hardware security foundation.

In the first nine months of 2019, companies reported a whopping 5,183 breaches that exposed 7.9 billion records, according to the 2019 Data Breach QuickView Report¹ This translates to a 33.3 percent increase in breaches from the year before and more than double the total number of records exposed.

As attackers evolve their techniques to go after the most sensitive data, security leaders need to think about where they can add more layers of protection to ensure that every part of every system is protected.

Security Snapshot ^{2 3 4}

Think Zero Trust. It’s a security concept based on the belief that organizations shouldn’t automatically trust anything inside or outside their perimeter but should instead verify everything trying to connect to its systems before granting access.

And while it sounds like the perfect scenario, reaching Zero Trust requires that organizations take a more holistic approach to security. That’s why Intel and partners across the PC ecosystem—from OEMs to component manufacturers—are working together to ensure that PCs are secured on both the hardware and software levels. The software ecosystem can innovate and build on this hardware security foundation to provide the best, up-to-date solutions to end customers. This will help organizations stay ahead of hacks, reduce risk, lower TCO, and achieve corporate goals—all while quickly remediating issues and enhancing the user experience.

Protect every endpoint

Today’s workers take their companies’ data with them wherever they go. They have to. Immediate access to insights helps them make split-second, informed business decisions. And because PCs are the device of choice for mobile workers, it means their devices, applications, data, and identities need to be protected.

That’s why the industry is moving toward increasing security through client virtualization. Major ecosystem partners (including OSVs, OEMs, and ISVs) have virtualization-based solutions that require client hardware to support virtualization, which can give systems greater flexibility (application compatibility), security, performance, and resilience. For example, Microsoft built virtualization-based security (VBS) into Windows 10 OS. This virtual secure mode isolates a region of memory from the normal OS to better protect against vulnerabilities and prevent breaches. However, because VBS strengthens software and OS security, hackers are now moving further down the stack, targeting firmware.

So, not only do you have to secure your software, you need to secure your hardware too. At Intel, we are intimately familiar with the cyberthreats organizations are facing, and we have taken action to protect our customers and their data. Built into the Intel vPro® platform, Intel® Hardware Shield provides integrated hardware and software features. Our platform is built, tested, and works together to help provide strong security, supporting its other core capabilities around performance, stability, and manageability.

Here’s an example of how we keep PCs secure: Intel® Hardware Shield strengthens VBS using hardware-based security features to protect computers as they’re running. Below-the-operating-system capabilities also support a secure boot, launching systems into a trusted state. To minimize the risk of malicious code, we lock down memory in the BIOS to prevent planted malware from gaining high privileges and compromising the operating system.

Increase hardware/software visibility

In order to accurately assess the security of your systems, your teams need visibility into firmware security measures. DRTM—also known as the dynamic root of trust for measurement—is built into Intel® Hardware Shield and provides hardware-to-software security visibility. This allows you to verify that operating systems are running on legitimate hardware (components legitimately sold on the market). It also protects your systems from malicious code—one of the primary vectors for major attacks.

With additional visibility, you can ensure your operating system enforces a more complete security policy—all with no additional IT infrastructure required.

Speed up your response

Cyberattacks can happen without warning, so it’s important to ensure you can deploy security patches at a moment’s notice, anywhere your workers are located—even if the patch was released at some time other than its normal release date. This requires a remote management system that can help you remediate infected devices out of the box, so users can get back to work with minimal delays. As part of our security-first pledge, Intel continues to work with partners to provide patches in a timely fashion, and ease how patches are deployed to end customers.

And the potential for savings is substantial, as estimated in a study using a composite organization. The Forrester study shows that IT managers and desktop operations specialists at the composite organization save a total of 832 hours deploying patches and handling in-person exceptions, adding up to more than USD 81,000 over three years.⁵

Authenticate PC purchases

A growing number of businesses are concerned with supply chain transparency —including how PC tampering might cause safety hazards or failure of critical business applications. However, trusting the sources in your supply chain is challenging. Processes for screening out counterfeit components are limited, especially for products with multiple subsystems. In fact, many companies buy IT equipment without knowing that counterfeit components have entered their systems.

In order to mitigate risk and increase integrity in your supply chain, you’ll need to ensure you have the proper levels of accountability and traceability for hardware, firmware, and system components. This is the aim of Intel’s Compute Lifecycle Assurance (CLA) initiative: to provide greater transparency and higher levels of assurance throughout every stage of the platform lifecycle. On the Intel vPro platform, this includes system and component level traceability linked to Intel Transparent Supply Chain (TSC) on the platform, as well as platform certificates providing digital proof of product origin. The end result is a more secure supply chain for your organization, and the industry.

Secure your foundation, secure your business

Staying one step ahead of hackers has never been easy. But with today’s advanced technologies in the Intel vPro platform, you can get a running start. For example, with advanced threat detection, your team can offload routine security functions for less user impact and uninterrupted productivity—without compromising performance.

Together with Microsoft and OEM partners, Intel is also developing secured-core PCs, which feature deep hardware-software integration and the latest Intel® Core™ vPro® processors for more robust threat protection. And we fully support National Institute of Standards and Technology (NIST) standards for risk management to help organizations around the world strengthen their cybersecurity practices.

How the Intel vPro® Platform Delivers ^{6 7 8 9 10 11 12}
Intel vPro® Platform Claims Based on Composite Organization. Read the full study at intel.com/vProPlatformTEI.

 

By securing your business PCs proactively at the foundation level, you can accelerate and scale security while enabling IT to reduce user downtime, interruptions, and delays.

The time for Zero Trust is now. And with the Intel vPro® platform, you can get there sooner than you think.