Enterprise Security with Endpoint Agents

Abstract

Enterprise security is complicated by the use of mobile devices. These devices roam outside the protections of the enterprise core network. They operate closer to threats while simultaneously being farther from the enterprise, which makes compromise more likely and response more difficult. This paper describes an approach using software agents installed on endpoint devices to maintain security of these devices and their associated enterprise. These agents monitor local activity, prevent harmful behavior, allow remote management, and report back to the enterprise. The challenge in this environment is the security of the agents and their communication with the enterprise. This work presents an agent architecture that operates within a high-security Enterprise Level Security (ELS) architecture that preserves end-to-end integrity, encryption, and accountability. This architecture uses secure hardware for sensitive key operations and device attestation. Software agents leverage this hardware security to provide services consistent with the ELS framework. Additional agents leverage this baseline security to provide additional features and functions. This enables an enterprise to manage and secure all endpoint device agents and their communications with other enterprise services.