Intel vPro In 2012, Small Business Advantage, And Anti-Theft Tech.

An Introduction To Intel Anti-Theft Technology

Intel's Anti-Theft technology is now in its fourth generation. More than anything, it's intended to prevent unauthorized parties from getting sensitive data by bricking a machine before its contents can be compromised. Sometimes, that might mean the system doesn't get recovered. But more important than the one or two thousand dollars of lost hardware is the potentially-priceless value of financial documents, customer lists, privileged medical records, and other information you simply cannot afford to have fall into the wrong hands.

Particularly as notebooks in general become viable desktop replacements that employees take with them on the road and then dock at home, theft becomes a larger issue. It's just not all that difficult to abscond with a two-pound Ultrabook. Should a thief snag your notebook at an airport, in a coffee shop, or on the subway, you simply call your help desk or Anti-Theft service provider, let them know, and they're able to push a poison pill, disabling the hardware immediately. Should the system be recovered, it's then possible to reverse the process.

Anti-Theft has its own list of requirements. First, you need to have hardware support. Intel pushes this feature aggressively, but not all OEMs enable it. A service subscription is also necessary. Once you pick a vendor for Anti-Theft service, your compatible hardware has to synchronize with the company's servers to activate protection. A quick glance at the Management Engine's Anti-Theft screen on our machine tells us that the feature is available, but not active.

Intel's Anti-Theft information page features four service vendors: Intel, McAfee (now Intel-owned), Symantec, and Absolute Software.

Intel has its own Anti-Theft service, which makes sense when you consider that the company sells hardware but still depends on a reliable software solution. By priming the market with its own offering, Intel enables a baseline service customers can lean on to take advantage of Anti-Theft.

McAffee, now an Intel subsidiary, currently offers a beta implementation. You can sign-up for it and get 90 days of protection under the beta program.

LoJack is probably best known as an automotive brand, but it's now being used to market a service for Intel's Anti-Theft technology. You can sign up for between one and three years of service with different features. All levels allow for location, locking, remote data deletion, and recovery. The premium offerings include an up-to-$1000 guarantee if Absolute doesn't recover the hardware or has to enable Data Delete.

Finally, Symantec has its own Norton Anti-Theft. Most people already know Symantec and its Norton brand for its anti-virus and security suites, so extending the family to include Anti-Theft is pretty logical.

Personally, I have several friends who have located lost phones with various mobile services. One thing they all had in common was never using the recovery interface prior to losing their devices. So, next, we'll look at what remotely locking a machine with Anti-Theft looks like.

  • bit_user
    Toms, you really need to blow the lid off the incredibly dangerous security flaws in vPro that can enable undetectable and irremovable rootkits. semiaccurate.com did some reporting on this. Please alert the mainstream. The exploit was already demonstrated some time ago.

    Thanks.
    Reply
  • bit_user
    I don't know if it's allowed, but here's the link:

    http://semiaccurate.com/2012/05/15/intel-small-business-advantage-is-a-security-nightmare/

    Maybe the editors will read it before they remove this post. It's not a terribly well-written article. That's where you can help, Tom's.
    Reply
  • freggo
    Why not integrate a GPS receiver into the motherboard and than have an option to define 'allowed' active areas for the system. For desktops that should be no problem as they do not get moved much.

    For laptops you may have to take a bit more time defining your typical usage area of course; you could even let the laptop track your typical usage location patterns so it can make recommendations for the best setup.

    If the systems is outside the area either request a special password or some other form of identification to unlock the machine either for one time or for inclusions of the current location into the allowed area.

    Damn, I should get that patented :-)

    Reply
  • bigdragon
    I have a hard time reading this lengthy article after all the trouble I've had with Intel's DBS1200KP and DBS1200KPR. Intel keeps promoting virtualization, but they failed to implement VT-d on that product even though there's no reason for it not to be supported.
    Reply
  • StitchExperiment626
    Backup is my complaint! Doing a full backup every night there isn't enough time.
    Reply
  • jkflipflop98
    Keep in mind, all the garbage you read on that site is by Charlie Demerjian. . . who honestly doesn't know much about anything.
    Reply
  • labtech drew
    Having owned an MSP (Managed Service Provider), with hundreds of customers, and thousands of machines under management, vPro add's enormous cost savings when implemented.

    Customer has a blue screen? No problem, you can KVM right in and see the issue.

    Workstation hung after remotely applying patches - calling the user and saying "Can you go over and hold the power button for me?" is no longer necessary. Simply shutdown the machine via vPro and power it back on. Even remotely re-imagine a machine from backup is possible.

    However, my favorite use case is the instant back to work use case. End user hard drive fails - obviously a truck roll is needed, but the most important thing is to get the user productive again. Leverage vPro's ability to redirect IDE (IDEr) to a network Live Linux CD at least gets the user in to Web Outlook, if not 100% back in business.

    How about power savings? Schedule machines to auto shutdown at night, and for your patch window, use vPro to power up the workstations, apply the patches, power down (from windows) and if a machine hangs on shutdown use the vPro power off command. Allows for nightly maintenance and keeps costs savings maximized.

    Rolling out vPro can be a bit of work using native tools, but there are solutions available (shameless plug) like LabTech Software (http://www.labtechsoftware.com) which can remotely provision and manage vPro along with any other IT management function you can think of.

    -Drew

    Full disclosure: Having ran an MSP and worked with many enterprises, out of band management tools were critical in every mature organization I worked with. As a co-founder of LabTech Software, I have engaged Intel and we are working closely to build out solutions that vPro truly solves for.
    Reply