Comment Dispelling some myths (Score 1) 399
- This isn't stealth technology - it's the opposite of stealth. Not only is it completely opt-in, you have to pay for it.
- This isn't in the processor, it's in support chips - they've added a "manageability engine" ("ME") to the chipset, not the processor.
- The SMS capability requires an integrated 3G modem from another vendor. There are specs that let the modem be connected to the ME, but I only know of one modem vendor that supports this today. If you don't have the SMS support, it still works over TCP/IP when the laptop connects to the Internet (assuming your management server has a leg in the DMZ)
- To support Anti-Theft, the laptop needs to go through an "activation" process that binds the laptop to a corporate, on-premises management server. Only this server can disable a laptop, and only via a command issued at the server. In other words, you call IT, you say your machine's been stolen, they shut it down.
- It's recoverable. You realize your brother just borrowed it, you call IT, they reactivate it.
- We're tying it to our whole disk encryption product, so all user credentials are also locked up when the kill pill is sent. This way, (a) your data is safe, and (b) even a weak password can't be brute forced. An attacker now needs to break a recovery token with 256 bits of entropy to get your data. We don't even let you buy anti-theft unless you already have WDE.
- It's not just about anti-theft. If you're taking your machine through customs, into a hostile area, or even shipping it across the country, you can now have it completely locked and cryptographically secure (even from insiders). If it gets "lost" in shipment, then you recover the laptop cost from insurance - but don't worry about the data loss.
- The idea is that if you slap an Anti-Theft sticker on the laptop, then a thief will move on to another system instead of stealing yours (expect a robust aftermarket in stickers
- You can use the same thing for decommissioning. You can send a "data kill pill" that lets you remotely wipe the user credentials, but leave the machine operational. This way you can sell a fleet of old laptops without worrying about all your (or your employees) data being sold on the open market.
- You can also set up a set of timers, so a laptop can be disabled if it doesn't check into your server for a configurable period of time or there are too many failed password tries. (This is a management server on your corporate network that also lets your admin set policy, see encryption state, last seen date, etc. so you know if a machine was encrypted when it was stolen.)
- No government, **AA, or third party can remotely disable the machine without access to the management server. This isn't about big brother, it's about trying to keep your data safe.
None of this is nearly as much fun as some of the comments I've read, but it happens to be true.