HP Inc. today announced enhancements to its HP Wolf Security endpoint protection portfolio with the launch of a new product to protect access rights to sensitive data, systems and applications.

HP Wolf Security’s Sure Access Enterprise is designed to prevent attackers from hijacking privileged sessions, even if a user’s endpoint device is compromised. The service keeps access to high-value data and systems secure, stopping minor endpoint breaches from turning into major security incidents.

Available for both HP and non-HP devices, SAE leverages HP’s task isolation technology to run each privileged access session within its own, hardware-enforced virtual machine. The use of a VM is said to ensure the confidentiality and integrity of the data being accessed, isolating it from any malware in the endpoint operating system. Using SAE, users are still free to conduct privileged, nonprivileged and personal activities securely from one machine, improving the user experience, reducing information technology overhead and enhancing protection.

The service recognizes that allowing users to perform privileged and nonprivileged tasks on the same PC comes with considerable risk. HP argues that even if a Privileged Access Management system is used to control access to privileged systems, attackers can potentially still usurp privileged sessions. With privileged access, those same attacks can steal sensitive data and credentials or insert malicious code and commands via injected keystrokes, clipboard capture, or memory scraping if the endpoint is compromised.

SAE uses advanced hardware-enforced virtualization to create protected VMs isolated from the desktop operating system and hence cannot be viewed, influenced or controlled by it. Therefore, confidentiality and integrity of application and data inside the protected VM can be assured, without the operational cost and complexity of issuing a separate privileged access workstation.

“By isolating tasks in protected VMs, which are transparent to the end user, Sure Access Enterprise breaks the attack chain,” Ian Pratt, global head of security for Personal Systems at HP, explained. “As well as protecting System Administrators accessing high-value servers, SAE can be used to protect other sensitive assets – for example, protecting credit card details accessed by customer support at a retailer, patient data access at a healthcare provider, or connections to an Industrial Control System at a manufacturer.”

Sure Access Enterprise is now available and includes integration with PAM solutions, including CyberArk Software Ltd. and BeyondTrust Corp., IPSec remote access tunnels and multifactor authentication. Centralized management in SAE enables the separation of duties and flexible policy options – such as locking connections to specific PCs or users or requiring HP Sure View activation for privacy.

Supported by Intel technologies, hardware root of trust prevents malware from bypassing security controls and encrypted, tamper-resistant session logging tracks access, without recording sensitive data or credentials, easing compliance.

Image: HP Wolf Security