Educause Security Discussion mailing list archives
Re: Peeling off desktop Administrator Rights
From: Eric Case <ecase () EMAIL ARIZONA EDU>
Date: Mon, 7 Dec 2009 12:25:19 -0700
Eric Case, CISSP eric (at) ericcase (dot) com http://www.linkedin.com/in/ericcase
-----Original Message----- From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of randy marchany Sent: Monday, December 07, 2009 9:44 AM To: SECURITY () LISTSERV EDUCAUSE EDU Subject: Re: [SECURITY] Peeling off desktop Administrator Rights I presume the primary reason for preventing local users from having admin rights on their desktops is to keep them from installing "evil" software. If this is so, then my question to the group is "how long does it take a desktop user to get a "legitimate" piece of software installed on their desktop? In other words, I have to use software package "A" to do my job. How long does it take for "A" to be installed on my desktop? My informal straw poll respondents noted the time range to be anywhere from 1 day to 2 weeks.This is completely shocking to me. Now, if my boss is breathing down my neck to finish a project by tomorrow & I need software "A" to finish the project, I can't wait 1-7 days. The business process will trump this security process and a) I go up the mgt chain to get an exception b) I bring in my personal computer, load software "A" on it and get the job done. So, I wonder why there has never been a survey with the question "How long does it take to install a software package on a user desktop if you restrict local admin rights?". This is the root cause of the "never ending battle" that I keep hearing about. If you make the user responsible for whatever they load on their machine AND enforce that, then what is the danger of letting them do so? Well, people with no local admin privs can still "infect" a machine by using their browser so once again, what do we accomplish by "preventing" them from loading software? Seems like nothing is accomplished, hence, the "never ending" battle. Call me silly, but I think there is an end to this battle but we don't want to put in the effort to accomplish this. That end involves a) enforcing user responsibility for their actions b) give them basic training (you want to be able to install stuff, you have to sit in this training) c) speed up legit software install requests. I keep hearing about this losing battle with the users so why not think of something radically different? Just a thought for the holidays.... Randy Marchany VA Tech IT Security Office
Current thread:
- Re: Peeling off desktop Administrator Rights, (continued)
- Re: Peeling off desktop Administrator Rights Stanclift, Michael (Dec 05)
- Re: Peeling off desktop Administrator Rights Stanclift, Michael (Dec 07)
- Re: Peeling off desktop Administrator Rights Kevin Shalla (Dec 07)
- Re: Peeling off desktop Administrator Rights randy marchany (Dec 07)
- Re: Peeling off desktop Administrator Rights Gary Dobbins (Dec 07)
- Re: Peeling off desktop Administrator Rights Dave Kovarik (Dec 07)
- Re: Peeling off desktop Administrator Rights Plesco, Todd (Dec 07)
- Re: Peeling off desktop Administrator Rights Iovino, Gabriel G (Dec 07)
- Re: Peeling off desktop Administrator Rights Eric Case (Dec 07)
- Re: Peeling off desktop Administrator Rights David Escalante (Dec 07)
- Re: Peeling off desktop Administrator Rights Eric Case (Dec 07)
- Re: Peeling off desktop Administrator Rights Eric Case (Dec 07)
- Re: Peeling off desktop Administrator Rights Eric Case (Dec 07)
- Re: Peeling off desktop Administrator Rights Stanclift, Michael (Dec 07)
- Re: Peeling off desktop Administrator Rights randy marchany (Dec 07)
- Re: Peeling off desktop Administrator Rights Eric Case (Dec 07)
- Re: Peeling off desktop Administrator Rights Flynn, Gerald (Dec 07)
- Re: Peeling off desktop Administrator Rights Flynn, Gerald (Dec 07)
- Re: Peeling off desktop Administrator Rights Flynn, Gerald (Dec 07)
- Re: Peeling off desktop Administrator Rights Eric Case (Dec 07)
- Re: Peeling off desktop Administrator Rights randy marchany (Dec 07)
(Thread continues...)