Debate: Is advanced malware no longer a problem when administrator rights are removed?

Share this article:
In this month's debate, experts discuss if advanced malware is still a persistent challenge after administrator rights are removed.


PRO

Mark Austin, CEO, Avecto

One of the most effective steps that can be taken to mitigate malware threats is to implement a least-privilege approach. The most dangerous and persistent threats often look to bury themselves deep inside the OS, using rootkits and other kernel-level techniques. It can then cloak itself from security solutions, making detection and removal problematic. 

In order for malware to infect the kernel, it must run in a privileged context or gain access to a privileged account, such as a local administrator. If a user logs on with an administrator account, malware can then gain access to a privileged context with ease, whereas if admin rights are removed, then it becomes much more difficult. It's no surprise that most of Microsoft's critical vulnerabilities state that users who logon to systems with fewer privileges will be less impacted. 

Detection of advanced malware has become challenging, and the only way to defend against it is to take more proactive measures, such as removing admin rights, patching in a timely manner and controlling applications.

CON

George Tubin, senior security strategist, Trusteer

First, removing administrative rights does not constitute a complete lockdown; users will still be able to install software, drivers, ActiveX controls and more. Therefore, users will still be able to unintentionally install potentially malicious files.

Second, advanced malware does not require user interaction or administrative rights to compromise an endpoint. Drive-by downloads, which exploit browser and browser plug-in vulnerabilities, can infect the endpoint when the user simply views a compromised web page (with or without administrative rights). Trusteer recently uncovered a malicious advertising campaign that used a Java zero-day vulnerability to automate the exploitation of the Java virtual machine. Embedded into ads that were displayed on legitimate websites, the exploit was able to automatically infect users with unpatched browsers when visiting these sites (without the users ever clicking on the ad).

 Malware prevention technology is the only effective way to prevent advanced malware threats.



Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in Opinions

Heartbleed, Shellshock and POODLE: The sky is not falling

Heartbleed, Shellshock and POODLE: The sky is not ...

While it may seem like 2014 is the year of the vulnerability, in reality, this year has not been much different than years past.

Technology alone isn't going to secure IoT connected devices

Technology alone isn't going to secure IoT connected ...

It's clear that vulnerabilities continue to exist, despite our best efforts to combat them. In fact, we have addressed many of the same problems before.

DDoS is the new spam...and it's everyone's problem now

DDoS is the new spam...and it's everyone's problem ...

As new solutions emerge, it's critical for organizations to protect themselves by being informed, aware, and acting whenever possible. Those that don't take action are playing a very dangerous game.