Method and system to enforce security on devices using device management layer

A device comprising one or more memory devices having instructions stored thereon that, when executed by one or more processors, individually or in combination, cause the one or more processors to run a device management client, wherein the device management client is configured to:

• receive, from a trusted environment on the device, by the device management client running as an application in the trusted environment on the device, a base product-platform profile of the device during an initialization process of the device, wherein the base product-platform profile indicates one or more control parameters of the device set at a time of installation of an application stack on the device;
• receiving, from a non-trusted environment on the device, by the device management client running as the application in the trusted environment on the device, a real-time product-platform profile of the device while the device is operating after the initialization process of the device is completed;
• compare the one or more control parameters in the base product-platform profile with corresponding one or more control parameters in the real-time product-platform profile of the device;
• and
• detect an attack to the device based on at least one of the one or more control parameters in the base product-platform profile being different from a corresponding control parameter in the real-time product-platform profile.