To continue reading for free, register below or login
To read more you must become a member of SearchEnterpriseDesktop.com
Politics is probably the second most difficult thing the balance against security (the first being money). This is what I use as a measuring stick. If someone can't provide a valid *business* justification for the escalated privileges, I fight strongly against providing them. If a business application requires escalated privileges, I escalate the issue with that vendor to make it clear to them that requiring escalated privileges is against the corporate security policy, and that if they can't provide a workaround, we won't be buying or using their product. In today's environment, many software vendors have more restrictive access requirements that they can run under, but that they do not always make publicly known (you need to ask for them).
If all else fails though, I then work under the basic premise of the most restrictive rights possible. So before I make a user a local administrator, I will check and see if they can do what they need to do as a power user. Before I make a user a power user, I will check to see if I can grant specific rights to the user (or more practically to a group the user is a member of) or specific rights to the appropriate registry keys or files.
The bottom line here though is that you are 100% correct in how you are approaching this issue, and unfortunately this is one of the more unpleasant aspects of security administration. Your best weapon is the ability to demonstrate how the users can perform all of their required business responsibilities at the lower privilege level. Good luck!!
View questions and answers from all of our Windows security experts here.
|
