McAfee ePolicy Orchestrator (ePO) Deep Command

McAfee ePolicy Orchestrator Deep Command Overview:

Call a halt to desk-side visits, truck rolls, and endless helpdesk calls due to security incidents or outbreaks. Finally, security administrators can deploy, manage, and update security on powered off and disabled endpoints. McAfee® ePolicy Orchestrator® (McAfee ePO™) Deep Command™ employs Intel vPro Active Management Technology (AMT) for automated, beyond-the-operating system management, reducing operational costs, enhancing security and compliance, and "green" practices for idle PCs.

Description:

McAfee ePO Deep Command provides secure and remote security management access to PCs that may be powered off or disabled. ePO Deep Command utilizes Intel® vPro™ Active Management Technology (AMT) to deliver beyond the operating system management, reducing security operations costs while enhancing your security posture. Using Intel vPro AMT, ePO Deep Command enables secure remote access regardless of the PC’s power state so security administrators can remotely remediate compromised systems, enable energy-saving initiatives, wake systems, and apply proactive security.

By communicating with endpoints at a level beyond the operating system, ePO Deep Command allows security administrators to configure and remediate hard-to-manage endpoints from a central site, using an established and familiar management platform — McAfee ePolicy Orchestrator.

Deploy security ahead of an attack — Switch on the powered-off PCs to keep them up-to-date by installing the latest security updates, patches, service packs, and other important security tasks. You can even schedule a time to switch on your AMT systems using the AMT Alarm Clock feature.

Fast call for help — Whether the PC is local or remote, the administrator can connect to the disabled PC via AMT to conduct a remote boot from another .ISO image on the network.

Quickly remediate endpoints — Access PCs when disabled by connecting at the hardware level for secure remediation.

Reduce power while maintaining control — Decrease power consumption by encouraging and enforcing power-off policies, knowing that those systems are available for remote security control.

Benefits and Features:

Solutions:

Security administrators are assailed by increasing costs, threats, and business requirements. Each desk-side visit caused by malware or other threats can cost $250. That's expensive. It's also a challenge to physically reach every user's desk. Remote offices, teleworkers, and mobile employees depend on service desk calls and overnight shipments to the service depot. These busy users often ignore problems, working on noncompliant, vulnerable systems until a catastrophic failure, a lockout, or

At the same time, the endpoint threat landscape grows more dangerous by the day. Cybercriminals move quickly to exploit each new vulnerability, using botnets and websites to propagate stealthy and zero-day malware. And some malware can now deactivate operating system (OS)-level countermeasures, giving attackers command of

Adding complexity, CIOs under pressure to cut energy consumption see idle desktops as a "green" field. They would like to power off unused systems, yet need a reliable way to manage security and compliance and run IT processes—scans and updates—when these activities will least bother users.

Remote management to the rescue
Now, security administrators can communicate with and take low-level control of their endpoints, using automation and remote management to enforce security and policy compliance and reduce security operational costs. In addition to a better security posture, these controls allow adoption of

Using Intel vPro AMT technology, McAfee ePO Deep Command will access endpoints without relying on the operating system. This hardware level access enables administrators to power on systems, execute security tasks, and then return the endpoints to their previous power states. McAfee ePO Deep Command can even initiate the boot process from a network disk image or execute arbitary commands. These operations can all happen automatically through the alarm clock or on demand.

By communicating with endpoints at a level beyond the operating system, ePO Deep Command allows you to configure and remediate hard-tomanage endpoints from a central site, with the familiar management platform, McAfee ePO.

Figure 1. McAfee gains low-level control via Intel vPro.

Unlock the power of Intel vPro
McAfee ePO Deep Command helps you get the value of Intel vPro technology by leveraging the Intel Active Management Technology (AMT) alarm clock, remote wake up capabilities, and serial over LAN connections, as well as IDE Redirection. First, the McAfee ePO Deep Command Discovery and Reporting module discovers any AMT-capable PCs in your environment. Detailed reports ensure you know exactly which PCs should receive the ePO Deep Command agent. Once ePO Deep Command is installed on provisioned AMT PCs, you are ready to begin remotely managing these PCs beyond the operating system, at the hardware level.

Wake and execute
Administrators can now conduct security maintenance or time-intensive tasks during off hours, when end users will not be disrupted. Using the AMT Alarm Clock, security administrators can power on and wake up a PC to execute a defined series of security tasks, including:

• Security and configuration updates (including DATs)
• On-demand scans
• Scheduling of on-demand scans

Security ahead of the threats
With this broad control, security teams have new options for protecting endpoints ahead of emerging threats. Systems can be updated before a potential threat reaches them and countermeasures can be activated remotely, preventing any impact on user productivity and keeping data safe.

Out-of-band recovery of disabled endpoints
When there are problems, such as when an operating system has been disabled or a hard drive has failed, both administrators and end users will appreciate the convenience of integrated management activated by McAfee ePO Deep Command. Whether the PC is local or remote, the administrator can connect to the disabled PC via AMT to conduct a remote boot from another .ISO image on the network.

The Intel AMT Fast Call for Help function gives users an easy way to contact McAfee ePO administrators for help. The McAfee ePO administrator can quickly:

• Redirect the PC to boot from an image from another location on the network
• Collect forensics on malware
• Clean and repair infected, disabled, or quarantined systems without hands-on access

Enterprise scalability and reporting
McAfee ePO Deep Command enhances the McAfee ePO management framework, which is proven to scale to hundreds of thousands of endpoints. Designed to support distributed architectures and security management teams, McAfee ePO provides a unified security policy management and reporting environment for your entire McAfee security infrastructure. Now, it can take your policies and compliance initiatives beyond the operating system, too.

By extending the information you can include in McAfee ePO dashboards and reports, you can increase your visibility into each endpoint's compliance as well as the organization's overall security posture. Correlated data makes audit time easy.

Going green and clean
Since McAfee ePO Deep Command can wake up PCs, update policies, and then securely return them to a low power state, your business can safely embrace energy savings programs and pursue industry incentives to cut power consumption without compromising security.

System Requirements:

These are minimum system requirements only. Actual requirements will vary depending on the nature of your environment.

• McAfee ePolicy Orchestrator (ePO) 4.6 (Discovery and Reporting Module), ePO 4.6 P1 (McAfee ePO Deep Command)
• McAfee Agent 4.5 or higher
• Supported OS:
  • Windows 7
  • Vista
  • Windows XP
  • Windows 2008
  • Windows Server 2003
• Intel® vPro™ AMT supported versions: AMT 4.2, 5.2, 6.1.2, 7.0, 7.1.4

Documentation:

Download the McAfee ePolicy Orchestrator Deep Command Datasheet (PDF).