ation can be protected. This helps IT administrators improve compliance with strict regulations, minimise data breaches even after a laptop goes missing, and reduce post-incident costs.
Rapid local or remote policy-based detection and response
Security vendors are taking advantage of local and remote tamper-resistant triggers that can detect a suspicious condition:
- Excessive login attempts (local). Multiple failed login attempts in a pre-boot authentication (PBA) screen.
- PBA login timer expires (local). If the user does not log into the PBA screen successfully within the IT-specified time frame, the laptop enters theft mode.
- Rendezvous timer expires (local). A local, hardware-based timer expires if the laptop does not check in with the central server within an IT-specified interval of time. This feature is a local trigger implemented in hardware; it works regardless of network connectivity.
- Notification from server (remote) via IP-based network. A flag set in the central server triggers a poison pill, which is sent to the laptop via a wired or wireless LAN the next time the system checks in.
- Notification from server (remote) via 3G-based network. IT administrators can automatically or manually send a poison pill via an encrypted SMS text message over a 3G network. This allows IT administrators to remotely and rapidly trigger a lock down even without LAN/WLAN-based connectivity.
- PC tampering (local). A lock down can be triggered when Intel AT detects changes in the firmware of the laptop or removal of the CMOS battery.
These flexible responses allow IT to specify the conditions that determine a lock down or trigger the disabling of encryption credentials. Laptops themselves can now respond automatically, intelligently, and rapidly to a variety of suspicious circumstances.
Protect the asset, protect the data
When a suspicious condition is encountered, Intel AT responds based on IT policy. For example, Intel AT can disable the laptop by blocking its boot process at the hardware level. This prevents the system from booting from any device, including from a hard drive, secondary drive, USB drive, CD, DVD, or other peripheral device. Even if a hard drive is reformatted or replaced, the system remains disabled. Unable to boot, the laptop is essentially a ‘brick’ and of little use or resale value to a thief.
Intel AT can also delete or disable (block) essential cryptographic information required for encryption/decryption. Even if a thief gains access to encryption credentials, the keys or other essential cryptographic information stored in the system have been erased or disabled and cannot be used to decrypt the data. Only after IT restores the keys and reactivates the system can the data be decrypted again.
With Intel AT, assets and data can remain protected, giving companies more time to resolve an incident before an actual data breach occurs and notification requirements take effect.
Reactivation is fast and easy
Intel AT does not destroy user data. The boot process is only disabled, and data is not erased. (Key elements of encryption keys can be disabled or erased.) When a laptop is recovered, the IT administrator or an authorised user can rapidly restore the system using one of several methods. These include entering a local passphrase, entering a one-time recovery token generated by IT (or the user’s service provider), reactivation via a PBA module, or remote reactivation via an encrypted SMS message over a 3G network (requires a laptop with a 3G modem that supports Intel AT).
New in Intel® Anti-TheftTechnology (Intel® AT): Protection for decrypted data after resume from S3 sleep state
One of the traditional vulnerabilities of encryption on laptops occurs when a laptop resumes from standby (S3) sleep state. Files that were decrypted before the system entered sleep state remain decrypted when the system wakes. The decrypted data can be easily accessed by thieves, and even by unauthorised users who simply lift the lid of the laptop to steal the data. Access is allowed because, upon resume from S3, a traditional l