PRO
Mark Austin, CEO, Avecto
One of the most effective steps that can be taken to mitigate malware threats is to implement a least-privilege approach. The most dangerous and persistent threats often look to bury themselves deep inside the OS, using rootkits and other kernel-level techniques. It can then cloak itself from security solutions, making detection and removal problematic.
In order for malware to infect the kernel, it must run in a privileged context or gain access to a privileged account, such as a local administrator. If a user logs on with an administrator account, malware can then gain access to a privileged context with ease, whereas if admin rights are removed, then it becomes much more difficult. It's no surprise that most of Microsoft's critical vulnerabilities state that users who logon to systems with fewer privileges will be less impacted.
Detection of advanced malware has become challenging, and the only way to defend against it is to take more proactive measures, such as removing admin rights, patching in a timely manner and controlling applications.
CON
George Tubin, senior security strategist, Trusteer
First, removing administrative rights does not constitute a complete lockdown; users will still be able to install software, drivers, ActiveX controls and more. Therefore, users will still be able to unintentionally install potentially malicious files.
Second, advanced malware does not require user interaction or administrative rights to compromise an endpoint. Drive-by downloads, which exploit browser and browser plug-in vulnerabilities, can infect the endpoint when the user simply views a compromised web page (with or without administrative rights). Trusteer recently uncovered a malicious advertising campaign that used a Java zero-day vulnerability to automate the exploitation of the Java virtual machine. Embedded into ads that were displayed on legitimate websites, the exploit was able to automatically infect users with unpatched browsers when visiting these sites (without the users ever clicking on the ad).
Malware prevention technology is the only effective way to prevent advanced malware threats.
