OK, my apologies for the hype in the post title, but I was reading a recent study from Avecto, on “Mitigating Risk by Removing User Privileges” and the headline is sort of true.
The findings of this study were pretty interesting:
- Of the 147 vulnerabilities published by Microsoft in 2013 with a Critical rating, 92% were concluded to be mitigated by removing administrator rights
- 96% of Critical vulnerabilities affecting Windows operating systems could be mitigated by removing admin rights
- 100% of all vulnerabilities affecting Internet Explorer could be mitigated by removing admin rights
- 91% of vulnerabilities affecting Microsoft Office could be mitigated by removing admin rights
- 100% of Critical Remote Code Execution vulnerabilities and 80% of Critical Information Disclosure vulnerabilities could be mitigated by removing admin rights
- 60% of all Microsoft vulnerabilities published in 2013 could be mitigated by removing admin rights
We’ve always known the risks associated with “root” or “Administrator” levels of access, but this is good data to support the folklore / storytelling that is often used when discussing this topic.
From a consumer perspective, unfortunately Microsoft’s default is to set you up as an Administrator, so only the more security-aware end users are likely to run as a Standard user. In a corporate environment, our chances are much better, as we often provision users with a standard image and can enforce things better through Group Policy on Windows (and the corporate security tools for Macs are improving, as well)
Several years ago, I made these adjustments on my home network because I was tired of dealing with malware outbreaks from my teenagers’ use of our home systems. Taking away local admin rights created a bit more work for me when it comes to installing or updating applications, but occasionally using RDP to authorize an install was a lot less work than rebuilding their systems after a malware incident.
By the way – for “power users” who have a legitimate need to have admin privileges on their local systems, you can still get this benefit by setting them up to operate day-to-day in a Standard role, while providing a local admin-capable account for updates and installation.
It’s true that the execution of untrusted code is improving due to features like AppLocker, Software Restriction Policies, and similar features on OS X, Android, etc. will help but this does seem like one simple (and not so weird) fix can make the whole world safer.
You can read the full study here.
- Put Your Critical Data on Ice: Using Cold Storage
- Tips and Tools to Bolster Small Business Information Security
- Be Wary: Hackers are Readying Security Updates for XP Users
- Secure Coding: Educating for Real World Problems
The Executive’s Guide to the Top 20 Critical Security Controls
Tripwire has compiled an e-book, titled The Executive’s Guide to the Top 20 Critical Security Controls: Key Takeaways and Improvement Opportunities, which is available for download [registration form required].
Title image courtesy of ShutterStock