Abstract:
In some examples, a target device may store a policy that includes one or more conditions. For example, a condition of the policy may specify that each device of the multiple devices have a certificate that was deployed to each device when each device was provisioned. A condition of the policy may specify that each device of the multiple devices be within a predetermined distance (or within a particular distance range) from the target device. A condition of the policy may specify that each device of the plurality of devices have a beacon secret that is periodically broadcast out-of-band by a local beacon. While the conditions of the policy are satisfied, the target device may grant the multiple devices access to the target device. If the target device determines that the conditions of the policy are no longer being satisfied, the target device may deny (or reduce) access.
Abstract:
Systems and methods for securing network devices through the use of an out-of-band beacon are described. In some embodiments, a method may include broadcasting, by a gateway, a wireless beacon that is out-of-band with respect to communications between the gateway and a plurality of devices over a network, where the wireless beacon includes a token; receiving an encrypted packet at the gateway as part of the communications; decrypting the encrypted packet into an intermediate payload by the gateway using a public key, where the public key corresponds to a certificate provisioned to each of the plurality of devices; and decrypting the intermediate payload into a decrypted packet by the gateway using the token.
Abstract:
Systems and methods for hardware hardened advanced threat protection are described. In some embodiments, an Information Handling System (IHS) may include a processor; and a Basic Input/Output System (BIOS) coupled to the processor, the BIOS having BIOS instructions stored thereon that, upon execution, cause the IHS to: launch an Extensible Firmware Interface (EFI) gateway module; and determine, using the EFI gateway module, whether the BIOS instructions include malware.
Abstract:
Systems and methods for hardware hardened advanced threat protection are described. In some embodiments, an Information Handling System (IHS) may include a processor; and a Basic Input/Output System (BIOS) coupled to the processor, the BIOS having BIOS instructions stored thereon that, upon execution, cause the IHS to: launch an Extensible Firmware Interface (EFI) gateway module; and determine, using the EFI gateway module, whether the BIOS instructions include malware.
Abstract:
In accordance embodiments of the present disclosure, a method may include, during execution of an operating system on an information handling system and responsive to a user input indicating a desire to invoke a basic input/output system (BIOS) setup program for configuring a BIOS, prompting for and receiving user-provided credentials via a user interface communicatively coupled to the processor. The method may also include, during execution of the operating system, passing BIOS credentials to the BIOS based on the user-provided credentials. The method may additionally include, during execution of the operating system determining, by the BIOS, if the BIOS credentials are valid. The method may further include, responsive to determining that the BIOS credentials are valid, setting a flag to a value indicating that the BIOS setup program is to be invoked on a subsequent boot of the information handling system.
Abstract:
Context captured with sensors of an information handling system is applied to selectively lock access to currently unlocked information, with conditions for locking access based upon the context. Nervous states enforce locking of selected information based upon the confidence of the security of the information under sensed external conditions. Increased sensitivity for locking access includes reduced timeouts to a lock command, increased response to sensed conditions, and more rapid response where unlocked access is to sensitive information.
Abstract:
A method may also include receiving from each of one or more of potential peer information handling systems a connection request comprising a peer minimum acceptable security level for the peer information handling system. The method may additionally include comparing the peer minimum acceptable security level to a security level of the information handling system. The method may further include completing a peer-to-peer connection between the information handling system and the peer information handling system if the minimum acceptable security level is not higher than that of the security level of the information handling system.
Abstract:
Unauthorized copying of a transaction barcode is prevented by including a sensed condition or other publicly-accessible data with the transaction barcode for use as a comparison with the publicly accessible data determined at a barcode reader. If the sensed condition included in the transaction barcode indicates that the transaction barcode was generated for a different transaction, then the barcode reader invalidates the transaction. For instance, if the barcode was generated too distant in time, position, or sequential transactions, then the barcode reader invalidates the transaction barcode as an unauthorized copy of a transaction barcode generated for a different transaction.
Abstract:
Systems and methods are provided for managing capabilities of workspaces operating on an Information Handling System (IHS). A request is received from a user of the IHS for access to a protected resource. A security context and a productivity context are determined for operation of a primary workspace on the IHS. Two or more applications are identified for operation within the primary workspace, where the applications provide access to the protected resource, and where the applications include overlapping capabilities. Based on the security context and the productivity context for the primary workspace deployment, two or more of the applications with overlapping capabilities are selected for operation within the primary workspace.
Abstract:
Systems and methods support transfer of an Information Handling System (IHS) from a first individual to a second individual. Upon notification of the transfer of the IHS, a credential of the second individual is received and an inventory is generated of detected hardware of the IHS. The generated hardware inventory is signed using the credential received from the second individual and the signed hardware inventory is published, thus establishing the inventory at the time the transfer is initiated. Upon actual transfer of the IHS to the second individual, another inventory of detected IHS hardware is generated and the published hardware inventory signed using the credential of the second individual is retrieved. The inventory of detected IHS hardware generated by the second individual is compared against the signed hardware inventory generated at the time the transfer was initiated in order to identify any discrepancies in the IHS hardware.