Skip to content

Future-proofing PC fleets with the powerful pairing of Intel® Threat Detection Technology and AI-Native endpoint protection

Everyone enjoys a PC refresh – Processor performance joined by security as an important factor

The continued shift to hybrid work (and play) marked a significant departure from pandemic norms. While health protocols reverted, the digital realm saw enduring changes. Amidst this transformation, security has emerged as a crucial but often overlooked aspect of personal and business computing, joining (speed) processor power as a significant factor in users upgrading PCs.

And, despite the recent passing of co-founder Gordon Moore, Intel has continued to advance in its approach to innovation, including prioritization of attributes like security and efficiency, which speak to the needs of modern computing.

Hardware evolves for our new hybrid reality

Looking back, PC sales surged during the peak of COVID restrictions in 2020 and 2021.1 They saw a significant decline by 13.7% in 2022 and the first half of 2023 as restrictions eased, according to International Data Corporation data from August 2023.

This post-COVID normalization of PC sales may have served to mask a notable transformation underway in the form of hardware-based threat detection. For the past several years, business PCs have shipped with Intel Threat Detection Technology (Intel TDT), providing an added layer of security. This enhanced protection may already be integrated into your endpoint security software, which when paired with an Intel vPro powered machine can deliver an effective hardware plus software solution, helping to keep you safe from advanced threats.

Why boost security from the silicon layer?

Enabling security directly from the silicon layer adds a hardware ‘eye’ for malicious payloads like cryptomining and ransomware by applying AI to low-level silicon data for runtime threat execution monitoring. Intel is the world’s only chipmaker that has developed the capability to enable CPU-level telemetry to assist endpoint security software from leading vendors.

In order to avoid potential strain on computing resources from AI computations, Intel’s optimization of Intel TDT can shift compute-intensive workloads from the CPU to the integrated GPU, allowing threat detection to operate at high performance, while ensuring little to no impact on the end user’s other critical tasks. Integration with endpoint security software like ESET PROTECT also allows for shared detections, enhancing security for PC fleets.

When coupled with modern endpoint software like ESET PROTECT, recognized for its low impact on performance, low false positives rates, and multi-layered technology fed by industry-leading malware and threat research, security receives an immediate boost. While PC fleets with integrated security are becoming increasingly widespread in 2024, the ongoing demand for compute power highlights that security remains a journey, especially in the context of the demanding hybrid work model, which introduces new threats and demands for both processor power and efficiency.

Powering integrated security

Intel engineers aim to establish collective security through Intel TDT’s integration with leading security software vendors, delivering scalable protections primarily tailored for business fleets. ESET, with millions of business endpoints in the SMB segment alone, integrated Intel TDT with ESET PROTECT in March 2022 via ESET Endpoint Security. This integration allows the ESET detection engine to co-validate threats with Intel TDT, leveraging ESET’s telemetry and both protection and prevention capabilities, and simultaneously ensuring high efficacy security without compromising system performance.

The collaboration extends from select 9th Gen Intel® Core™ processors to the latest Intel® Core™ Ultra processors, leveraging improved hardware telemetry capabilities in Intel’s processors for enhanced threat monitoring. These enhanced detections leveraging TDT’s CPU telemetry + AI-based technology and ESET Endpoint Security provide an additional layer of security for SMBs, augmenting ESET’s multilayered security solution without requiring additional micromanagement by security admins.

Hybrid work demands performance, efficiency, and security

Hybrid work necessitates steady advances in performance, efficiency, and security, which means that Moore’s Law remains relevant in supporting these demands, particularly with hardware-based security. While updates to processors still prioritize performance, there’s a noticeable shift toward deploying multicore solutions with distinct cores built for performance and those built for power efficiency.

In March 2023, IDC recognized Intel’s success in advocating for a PC refresh to enhance the end-user experience, elevate remote management capabilities, and establish a layered defense between hardware and software2 via Intel TDT. Furthermore, this alignment with modern work methods, such as hybrid work arrangements and online collaboration, enhances productivity while keeping efficiency and security in mind, without a compromise.

Regarding security, IDC also highlights the effectiveness of Intel vPro’s hardware-based AI threat detection and silicon-based Windows 11 virtualization in improving detection efficacy while reducing a computer’s attack surface.

Conclusion: Securing hybrid work is influencing hardware and software providers

In conclusion, the integration of ESET PROTECT with Intel TDT reflects a collaborative shift in the cybersecurity landscape, offering opportunities for wider integration among hardware and software providers. IDC emphasizes that modern endpoint security extends beyond software products, encompassing collaboration among various stakeholders in the ecosystem. This collaborative approach is timely, given the evolving cybersecurity needs of hybrid work environments, collaboration tools, and cloud services.

While the holistic approach demonstrated by the ESET – Intel integration is delivering immediate value to ESET’s customers, it also underscores the importance of incorporating enhanced prevention and protection measures when refreshing PC fleets for hybrid work. ESET R&D teams are collaborating with Intel to leverage future generations of processors to ensure the best of hardware and software are working together to deliver robust security solutions.

1Forbes, July 10, 2020 – Gartner’s preliminary PC sales results for the second quarter of 2020 show huge gains for several of the leading PC makers, not least HP, which saw sales increase by 17.1% year-on-year to push the company within a whisker of reclaiming its spot as the world’s biggest maker. Lenovo clings to that title, shipping 16.197m units in the quarter to HP’s 16.165m.

2IDC, Quick Take, Can your PCs deliver the end-user experience, manageability, and security you need now and in the future?, #lcUS50531323; March 2023

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Preparing for UEFI bootkits. ESET discovery shows the importance of cyber intelligence

Roman Cuprik

Some threats bypass standard security tools. In such cases, security operators capable of deep analysis are needed. 

Last year, ESET Research confirmed rumors concerning BlackLotus, the first publicly known UEFI bootkit capable of bypassing a UEFI Secure Boot, being sold on underground forums. This means that malware preying upon fundamental weaknesses in the UEFI security model is in-the-wild and experts are expecting more bootkits like BlackLotus in the near future.

“Bootkits are no longer just a threat to legacy systems, but a real threat to the majority of modern UEFI firmware systems,” said ESET Researcher Martin Smolár, who discovered this previously undocumented real-world UEFI bootkit and presented his finding at the 2024 RSA conference.

This threat creates a challenge for businesses: How to take a prevention-first approach and secure their devices against attacks that cannot be fully prevented simply by following the standard recommendations and using default system settings because there are known vulnerabilities that still haven’t been fixed and might never be fixed?

Despite businesses holding the short end of the stick right now, they are not without hope. In fact, these are the situations where cyber intelligence platforms such as ESET Threat Intelligence shine.

Confirmed myth

In a nutshell, UEFI bootkits are serious threats targeting Windows that gain full control over the operating system (OS) boot process. With this level of capability, they can disable various OS security mechanisms and are able to operate very stealthily and with high privileges.

The initial attack vector is unknown, but UEFI bootkit starts with the execution of an installer deploying the bootkit’s files to the EFI  System Partition. This abbreviation stands for Extensible Firmware Interface System Partition, which stores files needed for booting operating systems.

Using this installer, attackers can disable the first two layers of defense: Hypervisor-protected Code Integrity (HVCI) and BitLocker encryption. Then they reboot the host.

After the first reboot, the malware abuses the known vulnerability CVE-2022-21894, allowing attackers to enroll their own Machine Owner Key (MOK). An MOK allows owners of devices running non-Windows OSes to generate keys that sign non-Microsoft components during the boot process, thus allowing only approved OS components and drivers to run. By abusing this boot security feature, attackers achieve persistence.

The computer now thinks that the system is booted using trusted software, which means that attackers have bypassed another layer of protection, UEFI Secure Boot, and the machine is then again rebooted.

In the next stages, the self-signed UEFI bootkit is executed and deploys the kernel driver, having access to the Kernel, a computer program at the core of a computer’s operating system, which generally has complete control over everything in the system. It also deploys a user-mode HTTP downloader responsible for communication with the C&C. The abused device can now receive and execute commands from C&C and download additional user-mode or kernel-mode payloads.

Businesses are not powerless

Looking at this cascade for the hijacking of a compromised computer, and knowing that there is no effective fix for older devices due to their outdated security mechanisms, one may feel as if their hands are tied.

But businesses can protect themselves and apply a prevention-first approach even in these cases.

  • First of all, businesses need to keep their system and security products up to date, decreasing options for attackers.
  • IT staff should learn possible risks and procedures concerning how to decrease them. Microsoft released a threat description and a guidance for investigating UEFI attacks.
  • If needed, set up a custom secure boot policy. This, however, requires an experienced admin and is manageable only with a handful of devices due to its complexity.
  • Deploy reliable monitoring solutions and configure their integrity-scanning tools to monitor the composition of the EFI boot partition.
  • Block any attempts of modifying all or specific files on EFI System partition by untrusted processes to prevent bootkits installation.
  • Track developments with UEFI malware across Threat Intelligence platforms and resources.

ESET solutions such as ESET Enterprise Inspector and ESET UEFI Scanner, which is part of the ESET Host-based Intrusion Prevention System (HIPS), can detect signs that something suspicious is happening with a device and alert IT admins. While ESET UEFI Scanner checks and enforces the security of the pre-boot environment, HIPS combines advanced behavioral analysis with the detection capabilities of network filtering to monitor running processes, files, and registry keys.

For more information, check the RSA presentation by ESET Researcher Martin Smolár, via the ESET research podcast, and the NSA BlackLotus Mitigation Guide.

Be one step ahead of threat actors

Since the discovery of the in-the-wild UEFI bootkit, Microsoft has released several patches, and experts across the world provided some guidance. But how to protect a business from the start, before all of this can happen?

To identify such new threats and customize their solutions to deal with them, global leaders in cybersecurity such as ESET invest a lot in research. ESET Threat Intelligence turns this effort into a service, providing businesses with curated global knowledge about threat actors’ activities, gathered by ESET analysts and experts.

Thanks to ESET Threat Intelligence, security engineers, analysts, or incident responders can learn about new threats ASAP, anticipating them and making better, faster decisions. This allows them to deploy a proactive defense, customize their security, and fight increasingly sophisticated cyberattacks.

Moreover, ESET APT Reports give businesses access to private, in-depth technical analysis together with threat mitigation tips. Every user with the APT Reports PREMIUM package will also have access to an ESET analyst for up to four hours each month. This provides the opportunity to discuss topics in greater detail and help resolve any outstanding issues.

Facing a challenge

UEFI Bootkits represent a challenge that is hard to tackle, however that is why it is so important for businesses and enterprises to have reliable cyber intelligence.

With a globally distributed network of security centers, ESET research labs never sleep and have immediate access to threat intelligence like no one else, thanks to the number and distribution of devices protected around the world. Combined with more than three decades of experience in cybersecurity research and product development, ESET can provide businesses with vital intel and use this knowledge to continuously innovate threat-defense techniques.    

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Locked Shields 2024: ESET bolsters Slovak cyber defense during live-fire NATO exercise

BRATISLAVA — May 3, 2024 — Experts from ESET joined with the combined team of the Slovak Republic and Hungary militaries to participate in Locked Shields 2024 – the biggest and most complex cyber defense exercise in the world. The live-fire exercise, involving 40 countries, saw ESET contribute security solutions and more than 50 experts to a number of tactical teams, ensuring a top-flight position for the central European country which participates in the annual exercise run by NATO’s Cooperative Cyber Defense Centre of Excellence (NATO CCD COE). 

With collaboration being the focus of the 14th annual exercise (the slogan being “Cooperation Is Our Protection”), ESET supplied the Slovak-Hungarian team with defensive capabilities which particularly contributed to the team’s top three placings in cyber threat intelligence, client-side protection, forensics and strategic communications, taking home an overall 4th place position among the 18 participating teams made up of similar cross-country units.

The Slovak-Hungarian team successfully followed its strategic objectives and was built not only on expertise and state-of-the-art security technologies, but most importantly on communication and intensive cooperation between the participants, who worked together to defend the vital infrastructure of fictitious country Berylia in the face of massive cyber attacks designed to cripple the country and create public unrest.

“Locked Shields promotes the concept that collaboration is one of NATO’s greatest strengths – increasing the level of protection for all member states, their people, businesses and critical infrastructure,” said Juraj Malcho, CTO of ESET.  “ESET is proud to support the Slovak Ministry of Defense in this live fire exercise, by providing experts in cyber security, forensics, threat intelligence, legal and strategic communications, as well as our XDR cybersecurity platform ESET PROTECT. Together, we are stronger against any powerful adversary wishing to cause disruption.”

The Slovak team was led by the Cyber Defense Center of Slovak Military Intelligence. During the exercise, the Slovak government sector was represented by experts from the ministries of defense, finance, interior, transport, and foreign affairs. ESET’s experts and technologies contributed to the rapid detection and response to cyberattacks. Experts from the Slovak branch of Palo Alto Networks and Orange Slovensko a.s. also helped with both securing and management of the infrastructure. The team dealing with cyberspace legal challenges was led by an expert from SIGNUM legal s.r.o. talented students and their professors from the Slovak University of Technology in Bratislava, Comenius University in Bratislava, the Armed Forces Academy of general Milan Rastislav Štefánik, and young Slovak talents studying at foreign universities also came to support the national team.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET Threat Intelligence increases cybersecurity visibility through Elastic integration

  • ESET announces strategic integration with Elastic Security, enhancing cybersecurity analytics and visibility through advanced threat intelligence feeds.
  • The integration offers deduplicated, highly curated feeds based on proprietary ESET research and telemetry.
  • Elastic users will benefit from enhanced geographical visibility, reduced false positives, prevention of IoCs, and contextual investigations.

BRATISLAVAMay 3, 2024ESET, a global digital security company, has announced another strategic partnership and integration, thanks to its unified API gateway. This development facilitates seamless connections with various cybersecurity vendors, such as the recent integration with Elastic, a leading search AI company. This move is part of ESET’s broader strategy to support multi-vendor integrations aimed at strengthening overall cybersecurity defenses. By working with Elastic, ESET aims to provide organizations with enhanced analytics tools and greater visibility to enable more effective preventive measures against cyber threats.

Through this strategic partnership, Elastic’s users gain access to ESET’s advanced threat intelligence feeds, offering real-time data on indicators of compromise (IoCs), such as botnets, malicious domains, files, URLs, and IPs. These feeds also provide deep insights into the operations of notorious APT groups, sourced from ESET’s extensive malware and threat research. This integration enriches Elastic’s SIEM product, enabling security operators to leverage globally sourced threat data for unprecedented geographical visibility, dramatically reduced false positives – allowing for more accurate threat detection and analysis – and contextualized threat investigation.

The collaboration brings to the table ESET’s deduplicated and highly curated feeds, ensuring maximum effectiveness. Unique insights are drawn from proprietary ESET research and telemetry, not reliant on third-party sources. For optimal integration and interoperability, these feeds are delivered in the widely recognized TAXII/STIX 2.1 format.

ESET’s technological framework continuously scans for threats across various layers, from pre-boot to the resting state, providing global telemetry on emerging threats. This automation, supported by ESET’s leading cybersecurity team and 13 R&D centers worldwide, accelerates threat investigation and response. While machine learning aids in automating decisions, it’s ESET’s human expertise that underpins the evaluation and interpretation of threats, ensuring unparalleled accuracy and reliability.

“Our collaboration with Elastic not only marks a milestone in threat intelligence integration, but also represents a shared commitment to securing the digital landscape,” remarked Trent Matchett, ESET Director of Global Strategic Accounts. “By combining our unique insights and unparalleled expertise with Elastic’s analytical prowess, we’re setting a new standard in cybersecurity, empowering organizations to improve their security posture and make crucial decisions faster.”

For more information on how the ESET and Elastic integration is redefining cybersecurity threat intelligence, and to learn more about the benefits it brings to organizations, please read here.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

[重要通知] 伺服器將於 2024-05-08 (2:30 pm) 至 2024-05-08 (6:30 am) 進行定期維護

重要通知!

ESET 計劃進行維護工作,將於香港時間 2024 年 5 月 08 日(星期二)下午 2 時 30分 至 下午 6 時 30分之間進行,維護時間大約為 4 小時。

在此段期間,客戶可能無法進行續期購買、啟動及生產授權。

不便之處,敬請原諒。

技術支援熱線: (852) 2893 8186 或電郵至: support@version-2.com.hk

IMPORTANT ! 

ESET planned to maintain which will take place on
Tuesday, May 8th, 2024, from 2:30 PM to 6:30 PM, Hong Kong Time lasting 4 hours.

It means in certain time within the maintenance window, customers might not renewal purchase, activate license or generate license, etc.

Sorry for any inconveniences caused.

Support Hotline: (852) 2893 8186
Or email to support@version-2.com.hk

About Version 2

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.