Managing intrusion events using a management controller
Methods and systems for managing intrusion events for endpoint devices are disclosed. To manage intrusion events, an endpoint device may include a management controller. In response to an intrusion event, the management controller may perform a forensic analysis to identify an impact of the intrusion event. The management controller may snoop communications between hardware components of the endpoint device to identify any hardware components compromised by the intrusion event. A forensic report may be obtained based on the snooped communications and an action set may be performed to remediate the impact of the intrusion event. The forensic report may also be provided to a remote server via an out of band communication channel.
1 . A method of managing security for an endpoint device, the method comprising:
making, by a management controller that is physically installed within the endpoint device and that operates as a separate and independent computing device from the endpoint device, an identification that an intrusion event has occurred for the endpoint device;
performing, by the management controller, a forensic analysis of the intrusion event to obtain a forensic report, the forensic report indicating an impact of the intrusion event on hardware components of the endpoint device, and the forensic analysis being performed, at least in part, by snooping communication between the hardware components of the endpoint device, wherein the endpoint device comprises a network module adapted to separately advertise network endpoints for the management controller and hardware resources of the endpoint device, the network endpoints being usable by a remote server to address communications to the hardware resources and the management controller; and
performing, by the management controller and based on a policy keyed to at least a portion of the forensic report, an action set to remediate the impact of the intrusion event on the hardware components of the endpoint device.
2 . The method of claim 1 , wherein making the identification that the intrusion event has occurred comprises obtaining, by the management controller, an intrusion alert from a tamper detection device of the endpoint device.
3 . The method of claim 2 , wherein the tamper detection device comprises at least one device selected from a list of devices consisting of:
an intrusion detector;
a general-purpose input/output (GPIO) tamper detector; and
a serial communication tamper detector.
4 . The method of claim 1 , wherein the forensic report comprises:
an identifier for a first hardware component of the hardware components impacted by the intrusion event; and
a list of identified modifications made to the first hardware component during the intrusion event, the list being based at least in part on the snooped communications.
5 . The method of claim 4 , wherein performing the action set comprises at least one action selected from a list of actions consisting of:
disabling the first hardware component;
depowering the first hardware component; and
reversing the identified modifications.
6 . The method of claim 1 , further comprising:
providing, by the management controller and via an out of band communication channel, the forensic report to the remote server.
7 . The method of claim 1 , wherein performing the action set comprises:
providing, by the management controller, the forensic report to a startup management entity of the endpoint device to cause the startup management entity to revert impact of the intrusion event on the hardware components.
8 . The method of claim 6 , wherein the management controller and the network module are on separate power domains from the hardware resources so that the management controller and the network module are operable while the hardware resources are inoperable.
9 . The method of claim 6 , wherein the out of band communication channel runs through the network module, and an in band communication channel that services the hardware resources also runs through the network module.
10 . The method of claim 6 , wherein the network module hosts a transmission control protocol/internet protocol (TCP/IP) stack to facilitate network communications via the out of band communication channel.
11 . A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to perform operations for managing security for an endpoint device, the operations comprising:
making, by a management controller that is physically installed within the endpoint device and that operates as a separate and independent computing device from the endpoint device, an identification that an intrusion event has occurred for the endpoint device;
performing, by the management controller, a forensic analysis of the intrusion event to obtain a forensic report, the forensic report indicating an impact of the intrusion event on hardware components of the endpoint device, and the forensic analysis being performed, at least in part, by snooping communication between the hardware components of the endpoint device, wherein the endpoint device comprises a network module adapted to separately advertise network endpoints for the management controller and hardware resources of the endpoint device, the network endpoints being usable by a remote server to address communications to the hardware resources and the management controller; and
performing, by the management controller and based on a policy keyed to at least a portion of the forensic report, an action set to remediate the impact of the intrusion event on the hardware components of the endpoint device.
12 . The non-transitory machine-readable medium of claim 11 , wherein making the identification that the intrusion event has occurred comprises obtaining, by the management controller, an intrusion alert from a tamper detection device of the endpoint device.
13 . The non-transitory machine-readable medium of claim 12 , wherein the tamper detection device comprises at least one device selected from a list of devices consisting of:
an intrusion detector;
a general-purpose input/output (GPIO) tamper detector; and
a serial communication tamper detector.
14 . The non-transitory machine-readable medium of claim 11 , wherein the forensic report comprises:
an identifier for a first hardware component of the hardware components impacted by the intrusion event; and
a list of identified modifications made to the first hardware component during the intrusion event, the list being based at least in part on the snooped communications.
15 . The non-transitory machine-readable medium of claim 14 , wherein performing the action set comprises at least one action selected from a list of actions consisting of:
disabling the first hardware component;
depowering the first hardware component; and
reversing the identified modifications.
16 . A data processing system, comprising:
a processor; and
a memory coupled to the processor to store instructions, which when executed by the processor, cause the processor to perform operations for managing security for an endpoint device, the operations comprising:
making, by a management controller that is physically installed within the endpoint device and that operates as a separate and independent computing device from the endpoint device, an identification that an intrusion event has occurred for the endpoint device;
performing, by the management controller, a forensic analysis of the intrusion event to obtain a forensic report, the forensic report indicating an impact of the intrusion event on hardware components of the endpoint device, and the forensic analysis being performed, at least in part, by snooping communication between the hardware components of the endpoint device, wherein the endpoint device comprises a network module adapted to separately advertise network endpoints for the management controller and hardware resources of the endpoint device, the network endpoints being usable by a remote server to address communications to the hardware resources and the management controller; and
performing, by the management controller and based on a policy keyed to at least a portion of the forensic report, an action set to remediate the impact of the intrusion event on the hardware components of the endpoint device.
17 . The data processing system of claim 16 , wherein making the identification that the intrusion event has occurred comprises obtaining, by the management controller, an intrusion alert from a tamper detection device of the endpoint device.
18 . The data processing system of claim 17 , wherein the tamper detection device comprises at least one device selected from a list of devices consisting of:
an intrusion detector;
a general-purpose input/output (GPIO) tamper detector; and
a serial communication tamper detector.
19 . The data processing system of claim 16 , wherein the forensic report comprises:
an identifier for a first hardware component of the hardware components impacted by the intrusion event; and
a list of identified modifications made to the first hardware component during the intrusion event, the list being based at least in part on the snooped communications.
20 . The data processing system of claim 19 , wherein performing the action set comprises at least one action selected from a list of actions consisting of:
disabling the first hardware component;
depowering the first hardware component; and
reversing the identified modifications.