Benefits of Removing Administrator Access in Windows
I think most security people advocate removing administrator rights for normal Windows users, but I enjoy reading even a cursory analysis of this "best practice" as published by BeyondTrust and reported by ComputerWorld. From the press release:BeyondTrust’s findings show that among the 2008 Microsoft vulnerabilities given a "critical" severity rating, 92 percent shared the same best practice advice from Microsoft to mitigate the vulnerability: "Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights." This language, found in the "Mitigating Factors" portion of Microsoft’s security bulletins, also appears as a recommendation for reducing the threat from nearly 70 percent of all vulnerabilities reported in 2008.
Other key findings from BeyondTrust’s report show that removing administrator rights will better protect companies against the exploitation of:
* 94 percent of Microsoft Office vulnerabilities reported in 2008
* 89 percent of Internet Explorer vulnerabilities reported in 2008
* 53 percent of Microsoft Windows vulnerabilities reported in 2008.
I'd like to take this a step further. Let's compare a system operated by a user with no administrator rights -- but no antivirus -- against a system operated by an administrator *with* antivirus. I believe the no administrator rights system would survive more often, albeit not without some failures. Anyone know of a study like that?
Richard Bejtlich is teaching new classes in DC and Europe in 2009. Register by 1 Jan and 1 Feb, respectively, for the best rates.
Comments
The absence of AV certainly gives me a faster, more enjoyable user experience.
I haven't seen any studies, but what I see on a daily basis would support that. Malware is just able to shift too fast for AV to keep up. Running as admin can be like using flammable liquids to put out a fire.
http://www.eweek.com/c/a/Security/Is-System-Lockdown-the-Secret-Weapon/
Read the "Fight for (fewer) rights" section.
Another site summarized the results in table form:
http://nonadmin.editme.com/WhyNonAdmin
@Crazy Computer Dad - For an administrative "shell", just runas the command prompt. From there, you can even runas Explorer.exe to get an admin explorer window. (On XP anyway)
That is what I do, but I am comfortable with the command line in windows and unix. End users that run as admin are some of my biggest problems. They "need" admin and have the rank to force it, but there is no way I would be able to get them to runas anything.
A nice gui shell where they have temporary isolated privilege and access to the icons they need would be nice. It would be even better if it was like sudo and I could limit the controls they had access to. :-)
Now that I have written it out it gives me a few ideas...
In a previous job, the only people in the company that had desktop admin rights were IT - everyone else had them removed. I was in charge of monitoring (AV included) and guess where 90% of the infections occured? Thats right, IT.
He wrote a quick and simple article on it as well but it's not on our website, unfortunately. Wouldn't mind sharing it if it were.
Conclusion is we have no doubt that reducing user rights to a minimum would greatly reduce infections but then, the flaw of this quick study is that only 1 malware was used......
We were able to find and remove a lot of users with administrative privileges and access to some resources who don't have to have such rights according to our implemented security policies.