3 ms·
I use it to segment network access. The devices are on an untrusted network and VPN into a LAN based on the device assignment. Things like printers are on a se
by Spooky23 4y ago
I use it to segment network access.
The devices are on an untrusted network and VPN into a LAN based on the device assignment. Things like printers are on a separate network, and there’s no cleartext on the network.
In the case of laptops, if they fall out of certain compliance baselines, they get remote wiped or bricked.
- GekkePrutser 4y agoWe do this too, but based on 802.1x certificates. Devices without this don't get access to the internet and are relegated to a closed VLAN. But IME is not needed for this. The certs are issued through windows / mac management systems e.g. SCCM/Intune. They are also dependent on the current security state of the machine (e.g. no EDR installed -> only access to remediation network). Is IME really used in your case?
- Spooky23 4y agoDepends on the requirements. One I set this up years ago and it uses AMT - IME only provides a few functions although I don’t recall exactly what from memory. The key difference is that you can provide a level of assurance and multi-tenant access without an OS. For example you can run a hypervisor on the PC and have a few OS instances running.