Debate: Is advanced malware no longer a problem when administrator rights are removed?

Share this article:
In this month's debate, experts discuss if advanced malware is still a persistent challenge after administrator rights are removed.


PRO

Mark Austin, CEO, Avecto

One of the most effective steps that can be taken to mitigate malware threats is to implement a least-privilege approach. The most dangerous and persistent threats often look to bury themselves deep inside the OS, using rootkits and other kernel-level techniques. It can then cloak itself from security solutions, making detection and removal problematic. 

In order for malware to infect the kernel, it must run in a privileged context or gain access to a privileged account, such as a local administrator. If a user logs on with an administrator account, malware can then gain access to a privileged context with ease, whereas if admin rights are removed, then it becomes much more difficult. It's no surprise that most of Microsoft's critical vulnerabilities state that users who logon to systems with fewer privileges will be less impacted. 

Detection of advanced malware has become challenging, and the only way to defend against it is to take more proactive measures, such as removing admin rights, patching in a timely manner and controlling applications.

CON

George Tubin, senior security strategist, Trusteer

First, removing administrative rights does not constitute a complete lockdown; users will still be able to install software, drivers, ActiveX controls and more. Therefore, users will still be able to unintentionally install potentially malicious files.

Second, advanced malware does not require user interaction or administrative rights to compromise an endpoint. Drive-by downloads, which exploit browser and browser plug-in vulnerabilities, can infect the endpoint when the user simply views a compromised web page (with or without administrative rights). Trusteer recently uncovered a malicious advertising campaign that used a Java zero-day vulnerability to automate the exploitation of the Java virtual machine. Embedded into ads that were displayed on legitimate websites, the exploit was able to automatically infect users with unpatched browsers when visiting these sites (without the users ever clicking on the ad).

 Malware prevention technology is the only effective way to prevent advanced malware threats.



Share this article:

Sign up to our newsletters

More in Opinions

Unfair competition: Proactive preemption can save you from litigation

Unfair competition: Proactive preemption can save you ...

With each job change, the risk that the new hire will bring confidential information or trade secrets with him or her to the new company grows.

Hackers only need to get it right once, we need to get it right every time

Hackers only need to get it right once, ...

Hackers only need to find one weak point to steal valuable information. On the flip side, security pros need to account for every possible scenario.

Successful strategies for continuous response

Successful strategies for continuous response

While it isn't realistic for organizations to expect that it will never happen to them, a rapid, professional and continuous response can limit their scope and reputational impact.