Admin rights responsible for security leaks
94% of the risks of all Microsoft vulnerabilities rated as critical are mitigated by removing administrator privileges. Rights management experts complain that organizations still do too little to protect against attacks.
Mark Austin of Avecto says, "We believe the key to effective endpoint security is getting the foundations right. But even after some 20 years, we see organizations ignoring the fundamentals of endpoint security. They just keep jumping to the next 'latest generation' solution."
"Rights management and control over applications should be the cornerstones of endpoint security strategy," adds Avecto's Peretti. "Once they have that in place, the next step is for companies to build numerous stronger layers of defense on top of it. These measures have far-reaching implications for the ability to defend against cyberattacks. This goal is easier to achieve today than it was eight or 10 years ago. That's because companies can remove admin privileges and control their applications."
Austin and Peretti discussed the latest "Microsoft Vulnerabilities Report" by Avecto on security strategies and rights management. In the report, the experts analyzed Microsoft security bulletins from 2016:
- Microsoft reported a total of 530 vulnerabilities in 2016 and rated 36% (189) as "critical". Of these vulnerabilities rated as critical, 94% could be mitigated by disabling admin privileges. The year before, this was true for only 85% of all vulnerabilities.
- The latest and supposedly "most secure" Microsoft operating system, Windows 10, recorded the largest share of vulnerabilities of all operating systems (395). This was 46% more than Windows 8 and Windows 8.1 (265 each). Avecto's report notes that 93% of the vulnerabilities in Windows 10 can be closed via disabling admin privileges.
- 100% of the vulnerabilities affecting Internet Explorer can be mitigated by removing admin privileges. The same goes for 100% of the loopholes in the latest browser, Edge.
- 79 vulnerabilities affected Microsoft Office products. The year before, the number was 62, representing an increase of 295% for Office products since 2014. Of the 79 vulnerabilities affecting Office, 17 were designated as critical. This means that every company using the software was exposed to a potential threat.
Marco Peretti comments, "The results show the importance of adjusting admin rights to limit the risks of potential cyberattacks."
Press release Avecto
