Intel vpro Technology: Proven Value in Four Use Cases

Transcription

1 White Paper Intel IT IT Best Practices Intel vpro Technology March 2013 Intel vpro Technology: Proven Value in Four Use Cases Executive Overview In each use case, Intel vpro technology reduces management costs and decreases employee downtime resulting in greater employee productivity. Omer Livne vpro AMT Product Manager, Intel IT Steve Taylor Sr. Solution Architect, Business Client Platform Division Avi Zarfaty IT Strategic Finance Analyst, Intel IT To increase our ability to maintain, manage, and protect PCs while decreasing management costs, in 2011 Intel IT completed deployment of Intel vpro technology on Intel s client PCs. Intel vpro technology provides out-of-band (OOB) manageability, by implementing Intel Active Management Technology (Intel AMT). Intel AMT s OOB management operates at the firmware level and provides the following benefits: Enables the control of client PCs regardless of OS state, even in a pre-boot environment Makes client management less susceptible to issues that affect the OS Allows remote access to the PC including BIOS settings regardless of the system s power state or OS condition We evaluated the business value of four use cases based on Intel vpro technology that have been deployed at Intel: Enterprise-scale solution for remote management of self-encrypting drives. Using Intel AMT to remotely access the BIOS enables us to create an end-to-end solution to manage hardware-based whole-disk encryption. Remote passphrase reset. Service Desk technicians can access a PC s user interface remotely OOB, including on-screen error messages. This allows them to repair systems directly instead of having to talk employees through a diagnostic and repair process over the phone. Keyboard-Video-Mouse (KVM) Remote Control. Service Desk technicians can use hardware-based KVM Remote Control to diagnose and repair PCs even when the OS is non-functional. ISO mounts. Service Desk technicians can use Integrated Drive Electronics Redirection to boot from an ISO image, perform OS installs, share a drive remotely, or access the Microsoft Windows* Preinstallation Environment. In each use case, we found that Intel vpro technology reduces management costs and decreases employee downtime resulting in greater employee productivity. For example, Intel vpro technology reduces the time to resolve passphrase reset problems by 80 percent. Using KVM Remote Control and ISO mounts to solve a problem saves remote employees more than USD 100 on shipping alone and more than 10 hours of employee downtime, on average.

2 White Paper Intel vpro Technology: Proven Value in Four Use Cases Contents Executive Overview... 1 Background... 2 Analyzing Intel vpro Technology s Business Value... 2 Security Use Cases... 3 Support Use Cases... 4 Next Steps... 5 Conclusion... 5 For More Information... 6 Acronyms... 6 IT@Intel The IT@Intel program connects IT professionals around the world with their peers inside our organization sharing lessons learned, methods and strategies. Our goal is simple: Share Intel IT best practices that create business value and make IT a competitive advantage. Visit us today at or contact your local Intel representative if you d like to learn more. Background Intel s worldwide computing environment includes more than 100,000 PCs in 63 countries. More than 80 percent of these devices are mobile PCs that connect wirelessly to our network. At Intel, as at most companies, managing and securing these PCs especially for highly mobile employees is a key IT priority. During 2011, Intel IT finished enabling Intel vpro technology on all client PCs in use at Intel. Intel vpro technology increases our ability to maintain, manage, and protect PCs while reducing management costs. Our current environment consists of Intel Core i5 vpro and Intel Core i7 vpro processor-based systems with Intel Active Management Technology (Intel AMT), a component of Intel vpro technology. Over 80 percent of these systems use Intel AMT version 6 or above; the remaining systems use an earlier version of Intel AMT. Intel vpro technology is a hardware-based capability built into PCs that enables us to remotely perform many functions that previously required onsite support. We use this underlying capability to improve incident resolution and asset discovery, and to also increase enterprise security. Every PC, including desktops, laptops, notebooks, and business Ultrabook devices, in use at Intel is equipped with Intel vpro technology. Seventyfive thousand of these PCs have Intel AMT configured, and we are steadily increasing this number through ongoing PC refresh. To improve our ability to remotely manage our PCs and use certain features of Intel AMT, Intel IT partnered with Intel s Business Client Platform Division (BCPD) to test, evaluate, and suggest improvements to Intel Setup and Configuration Software (Intel SCS) to create a highly available, agile configuration and maintenance environment for our mobile systems. Intel SCS sets and defines the features of Intel AMT and governs how they behave on the client. Currently, our environment uses Intel SCS 8.1, and Intel IT and BCPD are collaborating to continually incorporate new features that benefit IT operations. Analyzing Intel vpro Technology s Business Value A key Intel vpro technology capability is out-of-band (OOB) manageability implemented through Intel AMT. Intel AMT s OOB capability, which operates from firmware and establishes a secure communication channel, enables remote control of client PCs without the use of client software, even in a pre-installation environment. This capability makes client management less susceptible to issues that affect the OS and allows remote access to the PC regardless of the system s power state or OS condition which is beneficial in many areas, such as information security, IT support, and ediscovery activities. We analyzed the return on investment (ROI) associated with four Intel vpro technology use cases currently deployed at Intel: Enterprise-scale solution for remote management of self-encrypting drives Remote passphrase reset Hardware-based Keyboard-Video- Mouse (KVM) Remote Control ISO mount In each use case, shown in Figure 1, we found that Intel vpro technology reduced management costs and employee downtime significantly. 2

3 Intel vpro Technology: Proven Value in Four Use Cases White Paper Security Support Enterprise-scale solution for remote management of self-encrypting drives Using Intel AMT to remotely access the BIOS creates an end-to-end solution to manage hardware-based whole-disk encryption Remote passphrase reset Out-of-band capabilities cut passphrase reset time by 80 percent Keyboard-Video-Mouse (KVM) Remote Control Ability to diagnose and repair PCs even when the OS is non-functional avoids shipping costs and decreases employee downtime ISO mounts using Integrated Drive Electronics Redirection (IDER) Service Desk technicians use IDER to remotely restore a crashed OS without a desk-side visit Figure 1. Deployment of use cases based on Intel vpro technology. Security Use Cases As the workforce continues to become more mobile, sensitive corporate data and intellectual property are increasingly at risk if the proper protections are not in place. As with most companies, information security is a high priority at Intel. We have identified two security-related use cases of Intel vpro technology that show significant ROI. These use cases take advantage of Intel AMT capabilities to remotely manage data security settings on self-encrypting drives and remotely unlock encrypted drives. ENTERPRISE-SCALE SOLUTION FOR REMOTE MANAGEMENT OF SELF-ENCRYPTING DRIVES To protect one of Intel s greatest assets intellectual property we require employees to use a whole-disk encryption (WDE) solution. We have deployed a hardwarebased WDE solution that addresses many of the operational and business challenges we have experienced with software-based WDE. The solution combines self-encrypting Intel Solid State Drives (Intel SSDs) with Intel AMT OOB capabilities, such as being able to remotely access the BIOS, to create an end-to-end enterprise-scale management solution for self-encrypting drives. As part of the solution, we developed a password management utility, manageability web services, and a secured database. 1 1 For more information on the hardware-based WDE solution, refer to the white paper, Managing Intel Solid- State Drives Using Intel vpro Technology, June Financial Methodology In our financial analysis of Intel vpro technology at Intel, we used an approach that differs from the typical method of comparing overall investment cost to all of the benefits gained. Determination of cost. Several years ago, we made the strategic decision to make mobile business PCs equipped with Intel vpro technology-based processors our plan-of-record system. This decision was based on the numerous benefits of such systems, including compatibility with emerging technologies and next-generation OSs, durability and reliability, a stable image, and resale price. With Intel vpro technology already a part of our PC fleet, it is difficult to identify a specific cost associated solely with Intel vpro technology because we do not attribute the price difference between consumer-class PCs and enterprise-class PCs specifically to Intel vpro technology, as others might. Also, at Intel we have built an infrastructure that meets our enterprise needs, such as information security and privacy, support for mobility and a wide variety of computing devices, and cost-efficient client maintenance and support. Intel vpro technology capabilities utilize this existing infrastructure with negligible incremental investment needed to support the use cases we are implementing further complicating the identification of the exact cost of Intel vpro technology. Determination of benefits. We found that benefits attributed to Intel vpro technology are heavily dependent on the context of the use case. At a high level there is a set of use cases that relates to providing remote support. Since Intel s robust support infrastructure provides physical hands-on technical support for more than 90 percent of employees on site, the productivity lost if they need technical support is moderate because a PC service center is not far away. However, for employees who are not located near a support center, Intel vpro technology s remote support capability dramatically reduces incident costs but does not have a significant impact on the support organizational budget due to economies of scale. In 3 out of the 4 use cases presented in this paper, since the benefits significantly increase once the employees do not have ready access to a PC service center, we anticipate that an enterprise that has a leaner support infrastructure or a higher percentage of remotely located employees would see greater benefits than what we ve described in this white paper. Due to the challenges in carving out the costs and benefits that directly relate to Intel vpro technology, we chose to articulate only the costs and benefits that directly relate to use cases presented. 3

4 White Paper Intel vpro Technology: Proven Value in Four Use Cases Self-Encrypting Intel Solid- State Drives (Intel SSDs) Self-encrypting drives (SEDs), such as the Intel SSD 320 Series and Intel SSD 520 Series, have a drive controller that automatically encrypts and decrypts all the drive s data as it s written and read. The disk encryption key is never present in the computer s processor or memory, where it could be accessed by hackers. The key used to encrypt and decrypt is securely stored only on the drive. Because the disk encryption key is encrypted with the Advanced Technology Attachment (ATA) passwords, the key is made accessible to the drive only after successful user authentication; without the key the data remains encrypted on the media. Authentication of the user is done within the SED by supplying the ATA user password, which is isolated from the OS. Therefore, any attacks on OS vulnerabilities cannot affect an SED s pre-boot process. SEDs offer the rugged reliability, responsive performance, better PC battery life, and flexibility and scalability of all Intel SSDs, with the added benefit of securing data. Their built-in encryption circuit alleviates the performance impact associated with a software-based whole disk encryption (WDE) solution. Both the Intel SSD 320 Series and the Intel SSD 520 Series use the Intel Advanced Encryption Standard New Instructions (Intel AES-NI) with 128-bit encryption, which is equal to the encryption strength of the majority of software-based WDE solutions and complies with the widely accepted FIPS 197 industry standard. Our approach to hardware-based WDE management provides benefits to end users, IT support personnel, and staff engaged in information security and ediscovery. The solution provides an increased ROI for Intel technologies already in use in our environment and reduction of our ongoing maintenance costs. We also do not have to purchase additional licenses for our software-based encryption solutions. At Intel, Intel SSDs are part of the default client configuration, 2 therefore we consider the WDE licensing and maintenance cost savings as net cost avoidance. REMOTE PASSPHRASE RESET The deployment of WDE solutions involves setting a passphrase. Our Service Desk technicians receive thousands of passphraserelated calls every year. Often one of the WDE software solutions we use can assist the users in resetting their passphrases themselves by answering security questions. However, in other cases, in incidents where Intel AMT in not present or enabled, a Service Desk technician uses the phone to guide employees through a fairly complicated task for resetting the passphrase. This process can be particularly difficult when language differences such as accents or dialects are present. To address passphrase-related calls, we developed a web-based application, called the Intel Generic Redirection Tool (Intel GRT), that uses a feature of Intel AMT. In these cases, Intel vpro technology automates the diagnostics process, so Service Desk technicians do not have to walk employees through the process over the phone. In our analysis, the use of Intel vpro technology for resetting passphrases reduces the time it takes to resolve a first-level support call ticket by 80 percent and the cost per ticket by 70 percent. Support Use Cases Remote Service Desk assistance is more time-efficient and cost-effective than deskside visits. Intel vpro technology enables Service Desk technicians to remotely support employees, providing additional value to employees who are not located near our Service Desk centers. Intel AMTenabled clients allow our Service Desk staff to take control of a remote PC quickly to troubleshoot and repair many hardware and software issues and use the Integrated Drive Electronics Redirection (IDER) feature to boot from an ISO image, perform OS installs, share a drive remotely, or access the Microsoft Windows* Preinstallation Environment. In our analysis, we found that on Intel campuses where employees do not have ready access to a PC service center, Intel vpro technology s support for KVM Remote Control and ISO mounts can save more than USD 100 on shipping alone and more than 10 hours of employee productivity per incident, on average. KEYBOARD-VIDEO-MOUSE (KVM) REMOTE CONTROL Unlike software-based KVM solutions, hardware-based KVM Remote Control is not limited to situations where the OS is working. Intel Core vpro processors with KVM Remote Control enable Service Desk technicians to diagnose and repair PCs even when the OS is non-functional a situation that accounts for a significant number of Service Desk calls. For example, our Service Desk technicians received about 4,000 boot issue-related calls in the second half of KVM Remote Control enables them to resolve such problems without a costly desk-side visit or sending the employee s PC to a Service Desk center. 2 See Accelerating Deployment of Intel SSDs throughout the Enterprise, October

5 Intel vpro Technology: Proven Value in Four Use Cases White Paper Here are two examples of recent Service Desk calls aided by Intel vpro technology: An employee with a corrupted profile was not able to log in to the OS from home. Using Intel AMT and KVM Remote Control, the Service Desk technician was able to log in with administrator privileges despite the employee s corrupted profile. The problem was resolved remotely in 30 minutes, preventing the employee from having to spend an entire day traveling with the affected PC to have it fixed. An employee contacted the Service Desk because she forgot her disk encryption password but did not know what sort of encryption her system used (softwarebased or hardware-based). The Service Desk technician used KVM Remote Control to connect to the system and, on discovering the splash screen for a self-encrypted solidstate drive, was able to help the employee change her encryption password. ISO MOUNT Employees often encounter boot-time problems. Intel vpro technology provides our Service Desk technicians with the ability to boot a crashed system remotely using an image file located either on a network drive or on the technician s PC. This ability, combined with KVM Remote Control, enables Service Desk technicians to restore a machine s functionality without a desk-side visit or the employee having to bring the PC to a Service Desk center. For example, an employee experienced a boot failure related to disk encryption. Using KVM Remote Control combined with an ISO mount, a Service Desk technician was able to repair the affected PC in about 30 minutes. The employee was located in an office with no onsite support; using the phone to guide the employee through the process of building a boot CD using a colleague s PC would have taken much longer. We estimate that we saved at least one hour of downtime and a lot of frustration for this employee. Next Steps We are currently working to implement several additional capabilities based on Intel vpro technology. One of these capabilities is client-initiated remote access (CIRA), often referred to as Fast Call For Help (FCFH). 3 FCFH will allow the use of KVM Remote Control and other Intel vpro technology capabilities outside the firewall, over the Internet. FCFH supports our overarching goal of increased IT support for our highly mobile workforce. The FCFH feature of Intel AMT allows Intel vpro technology-based platforms to initiate a secure connection to a gateway server residing in the enterprise demilitarized zone. Using FCFH, the IT administrator can remotely manage Intel vpro technologybased clients when the client system is located outside the corporate network. We plan to begin using FCFH at Intel in 2013, and are currently working on three FCFH use cases. We anticipate these use cases will expand the ROI potential for Intel vpro technology across the enterprise. Conclusion Intel vpro technology s OOB manageability, implemented through Intel AMT, helps us increase our ability to maintain, manage, and protect PCs while decreasing management costs. Several use cases deployed at Intel illustrate the business value of Intel vpro technology: Enterprise-scale solution for remote management of self-encrypting drives. The ability to use Intel AMT to remotely access the BIOS enables us to create an 3 Fast Call For Help (FCFH) is a feature of Intel AMT that allows Intel vpro technology platforms to initiate a secured connection to a gateway server residing in the enterprise demilitarized zone (DMZ). For more information, refer to end-to-end solution to manage hardwarebased WDE. Remote passphrase reset. Service Desk technicians can view the PC remotely OOB, including on-screen error messages. This allows Service Desk technicians to repair systems directly rather than talking employees through a diagnostic process over the phone. KVM Remote Control. Service Desk technicians can use hardware-based KVM Remote Control to diagnose and repair PCs even when the OS is non-functional. ISO mounts. Service Desk technicians can use IDER to boot from an ISO image, perform OS installs, share a drive remotely, or access the Microsoft Windows Preinstallation Environment. Intel vpro technology reduces the time it takes to resolve passphrase reset problems by 80 percent. Remote management of selfencrypting drives uses Intel AMT to remotely access the BIOS to create an end-to-end solution to manage hardware-based WDE. In the KVM Remote Control and ISO mount use cases, Intel vpro technology saves remote employees more than USD 100 on shipping alone and more than 10 hours of employee downtime, on average. We anticipate achieving even more savings and efficiency through the use of Intel vpro technology in additional use cases in the near future. 5

6 For More Information To get help with Intel vpro technology implementation, visit content/www/us/en/remote-support/ implementation-of-intel-vpro-technology. html?cid=sem116p15966 Visit to find white papers on related topics: Configuration Tips for Managing Mobile PCs with Intel vpro Technology Managing Intel Solid-State Drives Using Intel vpro Technology Achieving Long-term Business Value with Intel vpro Technology Evaluating Keyboard-Video-Mouse (KVM) Remote Control Enterprise-wide Deployment of Notebook PCs with Solid-State Drives Intel vpro Technology: From Provisioning to Use Case Implementation New Security Solutions Using Intel vpro Technology Acronyms CIRA client-initiated remote access FCFH Fast Call For Help IDER Integrated Drive Electronics Redirection BCPD Business Client Platform Division Intel AMT Intel Active Management Technology Intel AES-NI Intel Advanced Encryption Standard New Instructions Intel SCS KVM OOB ROI SED Intel SSD WDE Intel Setup and Configuration Software Keyboard-Video-Mouse out-of-band return on investment self-encrypting drive Intel Solid-State Drive whole-disk encryption For more information on Intel IT best practices, visit This paper is for informational purposes only. THIS DOCUMENT IS PROVIDED AS IS WITH NO WARRANTIES WHATSOEVER, INCLUDING ANY WARRANTY OF MERCHANTABILITY, NONINFRINGEMENT, FITNESS FOR ANY PARTICULAR PURPOSE, OR ANY WARRANTY OTHERWISE ARISING OUT OF ANY PROPOSAL, SPECIFICATION OR SAMPLE. Intel disclaims all liability, including liability for infringement of any proprietary rights, relating to use of information in this specification. No license, express or implied, by estoppel or otherwise, to any intellectual property rights is granted herein. Intel, the Intel logo, Core, vpro, and Ultrabook are trademarks of Intel Corporation in the U.S. and other countries. *Other names and brands may be claimed as the property of others. Copyright 2013 Intel Corporation. All rights reserved. Printed in USA Please Recycle 0313/JGLU/KC/PDF US