Solution Brief
Endpoint Security

Help Shrink the Attack Surface of Endpoints
with Hardware-Assisted Security
Stop advanced endpoint attacks with coordinated hardware and software defenses
Key Benefits• Reduce the Attack Surface
by 70%1
Shut down entire classes ofthreats with Dell PCs runningIntel® Core™ and Intel® Core™
Ultra processors on the IntelvPro® platform. Enhance andextend CrowdStrike Falcon®
platform protections acrossthe stack.
• Enhance Threat Detection
Uncover early indicators ofattack (IOAs) with hardwareenhanced exploit detection.
• Work with Zero Trust-CapableSolutions Maintain device trustwith full control over security
posture via remote access(SaaS) to hardware telemetry
and below-the-OS alerts.
• Optimize Security Investments
Realize the benefits andefficiencies that comefrom consolidating security
providers.
• Activate with Ease
Deploy CrowdStrike Falcon
solutions on a Dell device basedon the Intel vPro platform andtoggle on the capabilities tomonitor your devices.

Summary
Modern threats have advanced to easily circumvent traditional point security
software focused on blocking known malware, meaning that attacks often evadethese legacy software security tools. What’s more, attackers now employ
sophisticated techniques that target different layers of the computing stack, which
blend in with valid system processes. This malware-free approach now comprises
75%² of all attacks. To compound this, research from IBM shows that as many as
90% of successful cyberattacks originate at endpoint devices.³
Further, hybrid work has exposed corporate endpoints which access SaaS apps
outside of the traditional network security perimeter. These combined threats haveeffectively increased the attack surface and accelerated the adoption of cloudnative endpoint detection and response (EDR) and extended detection and response(XDR) software. However, to stay ahead of modern, fast evolving threats, it takes
deep ecosystem collaboration – across both hardware and software – to provide
seamless multi-layered protection across the attack surface.
To that end, Dell, Intel and CrowdStrike have co-engineered threat detection andresponse capabilities that combine the power of Dell Trusted Devices, the industry's
most secure commercial PCs⁴, with Intel’s silicon capabilities and CrowdStrike's
industry-leading endpoint security and XDR platform.⁵
Working together, CrowdStrike, Dell, and Intel’s layered solution reimagines
endpoint security for your business, extending beyond software protections tohardware-assisted security.

In-Memory Exploit
Detection Capabilities

Secure Devices,
Telemetry

Premium
EndpointSecurity

Over a dozen Intel vPro® Optimizations

Figure 1. Multiple Layers of Protection That Work Together

Solution Brief | Endpoint Security

The Expanding Attack Surface of the PC
As organizations harden one attack surface, threat actors moveto other, softer targets. Attackers now use even more stealthy
methods for exploit/initial access, as well as for post-exploit
malicious activities. Attackers often co-opt legitimate code togain initial access – for example, by re-using instructions alreadyloaded in memory. An increasing proportion of post-exploit
malicious activities operate without attackers writing malware
to the endpoint – for example, by using in-memory code
injection, Living-off-the-Land (LotL) binaries, and scripts.
Malware-free strategies can open the door to the stealthiest
advanced persistent threats (APTs), ransomware, and prevalentdual-use tools like Cobalt Strike or Sliver C2 conduct
reconnaissance ahead of attack payload execution. In particular,Cobalt Strike has shown up 161% more often in cyberattacks,
having “gone fully mainstream in the crimeware world.”6
Below-the-OS attacks similarly increased with hybrid work. Infact, in a recent survey of global IT decision makers, 69%
reported at least one device/BIOS-level attack in the last twelve
months. That’s up 1.5 times from the 2020 study.⁷

Defense-in-Depth Evolution – Hardwareassisted Attack Surface Protections
Combatting this advanced threat craft requires a tight couplingof hardware and software protections. Given today's
sophistication and volume of attacks, defense-in-depth iscritical. This way, if an attack bypasses one line of defense,
additional layers exist to disrupt the cybersecurity kill chain.
The good news: PC hardware security has advanced to provide
native protections designed to shut down entire classes ofattack and feed CPU telemetry to threat management consoles
for a rapid response. In fact, according to research conductedby IOActive, Dell commercial PCs with 13th Gen Intel® Core™
processors on the Intel vPro® platform have been shown todeliver a 70% attack surface reduction over 6th generation.1
Each new Intel vPro generation offers advances in security
protections, to help make security solutions like the CrowdStrike
Falcon® platform even more effective. SecOps teams that
deploy CrowdStrike cybersecurity software on Dell PCs
leveraging the Intel vPro platform activate a unique suite ofintegrated hardware and software capabilities to protect theirgrowing attack surface.

Overview of Each Technology at WorkIntel vPro®: Built for Business
For more than 16 years, the Intel vPro platform has provided acomprehensive silicon-based solution for business PC security,deployed on more than 300 million endpoints worldwide.
Secure foundations are established at every layer: hardware,BIOS/firmware, hypervisor, VM, OS, and applications. In
addition, remote keyboard/video/mouse temporary bootredirection, power controls, and seamless firmware updates
help you manage and fix systems in remote and hybrid work
environments. With validated protections tested with thebroadest range of security standards, Intel vPro platform
delivers 43 built-in MITRE ATT&CK countermeasures.8

Included with Intel vPro, Intel® Thread Detection Technology(Intel® TDT) provides increased security performance at thehardware level. With AI-powered security capabilities, IntelTDT helps prevent ransomware, cryptomining, and evenmemory scanning attacks.
Dell: The Industry's Most Secure Commercial PC
Dell Trusted Workspace reduces the attack surface of a fleet
with multiple layers of security. "Built-with" supply chain
security establishes a trusted PC foundation. Along with asecure development lifecycle and rigorous supply chain
controls, SafeSupply Chain solutions offer extra assurance ofproduct integrity (e.g., Dell-unique Secured Component
Verification).
Next, Dell-unique "built-in" hardware- and firmware-based
protections like SafeBIOS work to prevent and detect
foundational attacks below-the-OS, including unique features
like off-host BIOS verification and Indicators of Attack (IOA).
SafeID equips the device with a dedicated FIPS Level 3
security chip for credential protection and user authentication.
The Dell Trusted Device (DTD) Application works in concert
with these BIOS protections and the Intel ® Management
Engine to deliver additional Dell-only capabilities like off-hostfirmware verification.
Finally, "built-on" software security, delivered through anecosystem of best-of-breed partners such as CrowdStrike,provides integrated protection against advanced threats. For
those customers requiring additional support, Dell ManagedDetection and Response provides 24x7 services and support.
Falcon Insight XDR/EDR: Threat Detection and Response
Made Easy
CrowdStrike Falcon Insight® XDR helps to deliver complete
real-time endpoint visibility across the entire organization. It
accelerates security operations, allowing organizations tominimize efforts spent handling alerts and reducing time toinvestigate and respond to attacks. Falcon Insight XDR delivers
visibility and in-depth analysis with AI-native capabilities toautomatically detect suspicious activity and stop stealthy
attacks – and breaches.
Leveraging cloud-native services for dynamic behavior
detection and response in real time, Falcon Insight XDR delivers
immediate value with CrowdStrike’s innovative approach basedon IOAs. Using hardware & other telemetry data from thelightweight Falcon agent, the Falcon platform is powered byIOAs targeting unknown malicious behaviors. Each IOA focuses
on detecting the intent of what an attacker is trying toaccomplish, regardless of the malware or exploit used.
Optimizations for the Intel vPro platform bring new hardware
security capabilities to further enable CrowdStrike’s innovative
IOA approach. In addition to its complex network of behaviorbased IOAs, Falcon also sends AI-powered detections to theFalcon agent. These AI IOAs are generated from machinelearning models trained on enormous data sets, including
behaviors and telemetry obtained through features enhancedwith Intel processors running the Falcon agent.

2

Solution Brief | Endpoint Security

How Hardware-Assisted Security Works
As illustrated in Figure 2, CrowdStrike Falcon XDR/EDR can leverage
device-level telemetry from Dell commercial PCs running on Intel vPro,
as well as Intel TDT to detect the stealthiest attacks.

Figure 2. Tighten
the 'IT-Security
Gap' with hardware
and software
defenses that work
together

Use Cases
We'll breakdown two attack scenarios to demonstrate how these joint hardware and software capabilities activate todisrupt the kill chain before they do damage:
Use Cases

Description

Hardware-Assisted Countermeasures

Fileless
MalwareAttacks

Fileless Malware Attacks are now the dominant
execution method for all cyberattacks. Filelesstechniques such as execution in memory andLotL (native tools/script abuse) can evade legacy
EDR software solutions. For example, during anemail phishing attack, clicking a link can deploy
a Cobalt Strike beacon payload to execute initialaccess and establish a persistent back-doorcommand and control. This may be completely
undetected by legacy EDR software may look formalware signatures on disk and provide basic
memory scanning, but it is not tied to AI IOAs.
The ultimate cyberattack objectives could bedata exfiltration through ransomware, access tothe corporate VPN through DLL hijacking,coopting application memory execution throughROP attacks, or fault injection through BIOS level
SMM attacks.

Dell commercial PCs help provide the visibility and actionability needed
to disrupt these attacks, leveraging proprietary BIOS/firmware defensesand Intel® Control-flow Enforcement Technology (Intel® CET) to help
shut down the entire class of ROP attacks. CrowdStrike’s Hardware
Enhanced Exploit Detection (HEED) integrates Intel® Processor Trace(Intel® PT) CPU telemetry to extend memory safety protections forcoded injection techniques, across PC fleet generations. In addition,
CrowdStrike has re-imagined how to stop fileless attacks early in thekill chain by using the accelerated memory scanning algorithms of IntelTDT and its ability to offload processing to the Intel ® Graphics
Technology integrated graphics processor. The resulting 4-7x
performance⁹ acceleration helps ensure a performant user experience
while applying CrowdStrike’s dynamic IOAs to the memory layer – andit's only available on Intel® processor-based PCs. As fileless attacks
attempt to move down the stack, Dell SafeBIOS uses the Intel vPro
platform’s Intel® System Resource Defense technology to restrict
system privileges and malicious access to the OS.

FoundationalAttacks

Foundational Attacks are rapidly increasing as
OS-level security improves. Attackers arefrequently turning to rootkits and other firmware
vulnerabilities to unleash devasting privilegeescalation attacks – largely undetectable bylegacy EDR software alone. These foundational
attacks are extremely hard to detect andremediate across remote worker fleets.

Dell commercial PCs offer a first line of defense with built-in securityfeatures. For example, SafeBIOS IOA and off-host Intel® Converged
Security & Management Engine (Intel® CSME) firmware verification
give IT SecOps teams enhanced visibility into the trustworthiness of adevice. For improved visibility into foundational attacks, CrowdStrike
Falcon Insight XDR can help reveal potential firmware tampering anddeviation from the known good image by using telemetry from the Dell
Trusted Device Application. For remediation, the Dell Client Command
Suite uses the Intel vPro platform's out of band management capabilities
to equip administrators with remote keyboard/video/mouse (KVM) to
wake a device, wipe its main drive, or initiate an Intel® Firmware Guard
assisted firmware update to reliably reduce the possibility of in-the-fieldsystem crashes. Dell, Intel, and CrowdStrike’s coordinated capabilities
provides a unique, multi- layer defense-in-depth that improves a SecOps
team’s effectiveness and efficiency as they protect, correct, and respondto evolving cyberthreats.

Table 1. Attack Use Cases

3

Solution Brief | Endpoint Security

Simple Activation
With this three-way collaboration, theFalcon platform’s user-interface for IT
administrators includes a Prevention
Policies screen on which administrators
can enable both HEED and Accelerated
Memory Scanning (AMS) capabilities.
To help protect the broader fleet, IT
admins also can promote policies fromdetection to prevention. With the Dell
Trusted Device (DTD) Applicatione n a b l e d , b el ow-th e - OS tel e m etr y
supplements detection and response.
Device-level security notifications andalerts appear in Dell consoles (via theWindows Event Viewer). Admins can also
view BIOS-level weaknesses remotely in
the Falcon console, leveraging that same
DTD telemetry.

Get the Most from Your
Security Investments
Th e Cr owdStr ike Fa lco n p l at fo r m
deployed on Dell commercial PCs basedon the Intel vPro platform enhances XDR/EDR efficacy and performance. Dellcustomers can purchase CrowdStrike
Falcon solutions at the same time as theypurchase Dell Hardware 'on-the'box'.
Choose the option that is right for yourorganization. (Table 2)

Figure 3. With Prevention Policies, administrators can enable HEED and AMS
capabilities and take advantage of dual-use cases.
Target Customer

SolutionsEnterprise

Dell: Latitude, OptiPlex, Precision and Rugged, Intel vPro Enterprise

Table 2. Recommended Solution Pairing

You can also add CrowdStrike Falcon
solutions to your existing hardware atany time.
Watch the Demo Videoor contact: global.security.sales@Dell.com
Solution Provided By:[1] The latest Intel vPro based PCs provide an estimated 70% attack surface reduction
compared to four-year-old devices. Based on IOActive’s “Intel vPro 13 th gen AttackSurface Study” published March 2023 (commissioned by Intel), which evaluates IntelvPro devices powered by 13th gen Intel Core processors against four-year-old
Intel-based PCs on Windows OS. Details at www.intel.com/performance-vpro.
Results may vary.
[2] Source: CrowdStrike 2024 Global Threat Report[3] Source: IBM Endpoint Security[4] Source: Based on Dell internal analysis, September 2023. Applicable to PCs on Intelprocessors. Not all features available with all PCs. Additional purchase required forsome features.
[5] Source: Gartner Magic Quadrant, 2022
[6] Source: Cobalt Strike Usage Explodes Among Cybercrooks. Threatpost[8] Source: Intel evolves security capabilities on each platform and brings new innovation
and updates to existing features. Intel has the first and only hardware-based threat
detection of its kind that works to augment security software for high efficacy
detection of the latest ransomware, cryptojacking, supply chain style attacks andeven zero-day attacks. Additionally, Intel works with the largest eco-system to enablesilicon security features as part of a defense-in-depth strategy. Furthermore, Inteland Coalfire experts have completed an analysis of hardware security capabilities
available on Intel vPro systems against industry security controls (NIST, MITRE,TCG) with 43 built-in MITRE ATT&CK countermeasures.
[9] Source: CrowdStrike AMS Blog-March 2022. Crowdstrike found Intel® Threat
Detection Technology can boost scanning up to 7x, resulting in faster detection offileless attacks that are the #1 attack entry method. Falcon testing of offload memory
scanning to the integrated GPU compared to CPU scanning, as described in a recent
CrowdStrike blog. Details at www.intel.com/performance-vpro. Results may vary.

[7] Source: The Futurum Group, Endpoint Security Trends, 2023
All information provided here is subject to change without notice. Contact your Intel representative to obtain the latest Intel product specifications and roadmaps.
Performance varies by use, configuration and other factors. Learn more at www.Intel.com/PerformanceIndex.
Intel does not control or audit third-party data. You should consult other sources to evaluate accuracy.​​​Intel technologies may require enabled hardware, software or service activation.​​​​​​​
No product or component can be absolutely secure.
Your costs and results may vary
© Intel Corporation.

Please Recycle

05/24/DCC/PDF

4