A lot of companies install a UEM agent on employee's laptop to keep track of the health status of the laptop. And they allow the laptop to connect to the internal network if this UEM sends back "Healthy" status back to the server.
If a device is compromised, OS level privilege was obtained by the attacker. How can we prevent the attacker from killing the UEM agent and sending fake "healthy" traffic back to the server?
Traffic can be encrypted with server's public key, but this doesn't matter since attacker can obtain the public key in your machine with OS access.
Use Yubico key (U2f) to authenticate the agent before starting a session with the server. This helps a bit because this prevented session duplication attack, attacker could only do session riding. (private key is not stored on the system) But what if the attacker patch the agent instead of killing it?
Don't trust your UEM status?