Telemetry-initiated mitigations in a zero-trust computing environment
Information Handling Systems (IHSs) support pre-boot telemetry for use in a zero-trust environment. A pre-boot telemetry orchestrator of the IHS retrieves a factory-provisioned resource locator of a service that provides a location of a policy decision point of the zero-trust environment. The pre-boot telemetry orchestrator establishes an encrypted session with the policy decision point that is located using the factory-provisioned resource locator. Via the encrypted session, the pre-boot telemetry orchestrator receives a telemetry definition specifying pre-boot telemetry to be collected by the IHS. The telemetry is collected and transmitted during the pre-boot intervals according to the telemetry definition.
1 . An Information Handling System (IHS) supporting pre-boot telemetry for use in a zero-trust environment, the IHS comprising:
one or more processors;
a memory coupled to the processors, the memory storing program instructions that, upon execution by the processors, cause a pre-boot telemetry orchestrator to:
retrieve a factory-provisioned resource locator of a service that provides a location of a policy decision point of the zero-trust environment;
establish an encrypted session with the policy decision point that is located using the factory-provisioned resource locator;
via the encrypted session, receive a telemetry definition specifying pre-boot telemetry to be collected by the IHS; and
collect and transmit telemetry during the pre-boot intervals according to the telemetry definition.
2 . The IHS of claim 1 , wherein the resource locator comprises a network address of a rendezvous server that provides the location of the policy decision point.
3 . The IHS of claim 1 , wherein the telemetry definition specifies a boot mode for the IHS.
4 . The IHS of claim 3 , wherein the boot mode comprises a protected boot mode that only initializes hardware components validated as operating using factory-installed firmware.
5 . The IHS of claim 3 , wherein the boot mode comprises a network boot mode that boots the IHS from a network address specified in the telemetry definition.
6 . The IHS of claim 3 , wherein the boot mode comprises a protected boot mode that initializes hardware components based on their position in a trust chain of the IHS.
7 . The IHS of claim 1 , wherein the processor and memory of the IHS that operate the telemetry orchestrator are components of a remote access controller of the IHS that supports a plurality of sideband management connections with hardware components of the IHS.
8 . The IHS of claim 7 , wherein the sideband management connections of the remote access controller are used to collect telemetry during pre-boot intervals.
9 . The IHS of claim 1 , wherein the telemetry definition specifies hardware components of the IHS from which to collect pre-boot telemetry.
10 . The IHS of claim 1 , wherein the pre-boot telemetry is collected and transmitted without booting an operating system of the IHS.
11 . A method for pre-boot telemetry collection by an Information Handling System (IHS), the method comprising:
retrieving a resource locator from a factory-provisioned storage of the IHS, wherein the resource locator identifies a service that provides the location of a policy decision point of the zero-trust environment;
retrieving a factory-provisioned resource locator of a service that provides a location of a policy decision point of the zero-trust environment;
establishing an encrypted session with the policy decision point that is located using the factory-provisioned resource locator;
via the encrypted session, receiving a telemetry definition specifying pre-boot telemetry to be collected by the IHS; and
collecting and transmitting telemetry during the pre-boot intervals according to the telemetry definition.
12 . The method of claim 11 , wherein the telemetry definition specifies hardware components of the IHS from which to collect pre-boot telemetry.
13 . The method of claim 11 , wherein the pre-boot telemetry is collected and transmitted without booting an operating system of the IHS.
14 . The method of claim 11 , wherein the resource locator comprises a network address of a rendezvous server that provides the location of the policy decision point.
15 . The method of claim 11 , wherein the telemetry definition specifies a boot mode for the IHS.
16 . A computer-readable storage device having instructions stored thereon for pre-boot telemetry collection by an IHS (Information Handling System), wherein execution of the instructions by one or more processors causes the one or more processors to:
retrieve a factory-provisioned resource locator of a service that provides a location of a policy decision point of the zero-trust environment;
establish an encrypted session with the policy decision point that is located using the factory-provisioned resource locator;
via the encrypted session, receive a telemetry definition specifying pre-boot telemetry to be collected by the IHS; and
collect and transmit telemetry during the pre-boot intervals according to the telemetry definition.
17 . The computer-readable storage device of claim 16 , wherein the telemetry definition specifies hardware components of the IHS from which to collect pre-boot telemetry.
18 . The computer-readable storage device of claim 16 , wherein the pre-boot telemetry is collected and transmitted without booting an operating system of the IHS.
19 . The computer-readable storage device of claim 16 , wherein the resource locator comprises a network address of a rendezvous server that provides the location of the policy decision point.
20 . The computer-readable storage device of claim 16 , wherein the telemetry definition specifies a boot mode for the IHS.