Re: The value of 'least privilege'

[Steve Werby <smwerby () VCU EDU>]

I echo Joe and Jeff's sentiments.  And I find Randy's views extremely
valid.  There's no one size fits all solution in higher ed.  Our largest
school and another one of our schools have successfully transitioned
over 95% of their users to unprivileged accounts with no admin account
access.  To accomplish this they had to make a strong business case to
get executive level support, which in part included guaranteeing
acceptable turnaround on software installation (for our largest school
they guaranteed 24 hour turnaround).  Reducing potential data exposure
and freeing up IT staff for other efforts (less time spent installing
software than previously spent cleaning infected machines) are icing on
the cake.

I believe very strongly in eating your own dog food.  I run as
unprivileged user and use my admin account only when needed.  I've been
advocating that as an alternative to departments, particularly as a risk
mitigation method driving by our proctored risk assessment process.

I also feel that it helps if IT managers, business managers and end
users can actually see that they're running applications that are
vulnerable and understand the implications.  Something I'm exploring in
part to educate users and in part to provide them a tool to make it
easier to remediate vulnerabilities (for those who don't have IT support
or don't have IT support that regularly patches apps) is making the
Secunia PSI product available to them.  I've been in talks with Secunia
since last year about contracting to use it and though colleagues were
largely not very receptive, feedback I've gotten now that they've tested
it has been pretty positive.

--
Steve Werby
Information Security Officer
Virginia Commonwealth University
VCU Information Security - http://infosecurity.vcu.edu/
News, Tips & More - http://www.twitter.com/vcuinfosec
Best Practices - http://infosecurity.vcu.edu/docs/infosecbp.pdf

On 3/30/2010 1:56 PM, Howe, Joe wrote:
> I second Jeff's comments.
>
>
> We have hundreds of users running with standard user accounts.
>
> Faculty, laptop users and some desktop users get an additional domain
> account that has admin privileges.  They are trained on when to use it (and
> when not to).  So far we have only had one user install something that got
> them in trouble.  At the same time, we have dramatically limited the number
> of root level compromises (essentially zero) and the user based compromises
> we have seen are much easier to remediate.
>
> We started on this 5+ years ago with the IT staff and expanded from there.
> Every time there is a computer upgrade or employee turnover, we changed to
> the new setup.  Even with vista/7 we are keeping this model, despite the
> integrity level features that you still have - UAC provides too much leeway.
>
> A few things we have learned:
>
> - don't try to mix running with a user account with "taking away your admin
> privileges".  In the end, there needs to be a reason for them having an
> admin account but make that a separate decision.  This helps avoid the
> additional politics of taking things away.
>
> - start with the IT staff so they can know what users are facing.  Our IT
> staff advocate highly for this setup even in their homes.
>
> - be very familiar with Process Monitor (sysinternals) to troubleshoot those
> poorly coded apps
>
> - leverage application (or even OS) virtualization for those extremely
> poorly coded apps.  We have used both Softricity/App-V and Thinapp
>
> - audit the local admin group membership as a standard practice when you
> locally or remotely touch a machine to add another validation that there is
> no privilege creep
>
> It can be a long road but from the security principles and reality of OS'es
> and malware - it is a good direction.
>
> -Joe
>
> -----Original Message-----
> From: The EDUCAUSE Security Constituent Group Listserv
> [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Jeffrey I. Schiller
> Sent: Tuesday, March 30, 2010 11:26 AM
> To: SECURITY () LISTSERV EDUCAUSE EDU
> Subject: Re: [SECURITY] The value of 'least privilege'
>
> Of course there is a middle ground. People in general should run without
> administrator privileges (even people who know what they are doing!).
> But that doesn't mean that they shouldn't have access to a separate
> account with privileges which they use *occasionally* only to install
> software and other tasks that require privilege.
>
> In this case you don't have to wait, and you are also protected from a
> significant amount of malware.
>
> Of course the trick is for people to avoid becoming lazy and just
> running with privileges all the time... Human nature and all...
>
>                         -Jeff
>
> On 03/30/2010 10:46 AM, randy marchany wrote:
>
> > While I agree that limiting administrative rights is a good thing,
> > sites need to answer accurately the following questions:
> >
> > 1. How long does it take your IT staff to install software that an end
> > user needs?
> > 2. How long does it take your IT staff to check such software for
> > security issues? Presumably, this is the real reason why end user
> > aren't allowed to install software. If your IT staff doesn't check
> > software for security issues, they can make the same mistake. Do your
> > admins even check for security problems with vendor software? I
> > suspect it's not a thorough check.
> >
> > If the answers to the above questions are "long" and an end user needs
> > the software ASAP (who doesn't?), then the end user will find ways to
> > bypass this restriction in order to get the job done. Having a timely
> > software installation process is critical to the success of this
> > security solution. No sysadmin can anticipate what software is needed
> > at any given point in time.
> >
> > I'm curious to see what the answers are to the above questions. My
> > informal survey answers range from 1 day (ok) to 2 weeks (not ok).
> >
> > -Randy Marchany
> > VA Tech IT Security Office