Lack of admin rights mitigates most Microsoft vulnerabilities
The removal of administrator rights from Windows users is a mitigating factor in 75 percent of Critical Windows 7 vulnerabilities.
Microsoft and its partners regularly identify new security vulnerabilities in Microsoft software. In 2010 Microsoft published over 100 security bulletins documenting and providing patches for 256 vulnerabilities.
BeyondTrust examined and analyzed all of the published Microsoft vulnerabilities in 2010 and all of the published Windows 7 vulnerabilities to date, allowing their report to accurately quantify the continued effectiveness of removing administrator rights at mitigating vulnerabilities in Microsoft software.
The results of BeyondTrust research demonstrate that as companies migrate to Windows 7 they’ll need to implement a desktop Privileged Identity Management solution, to reduce the risks from unpatched Microsoft vulnerabilities without inhibiting their users’ ability to operative effectively.
Key findings from this report show that removing administrator rights will better protect companies against the exploitation of:
- 75% of Critical Windows 7 vulnerabilities reported by Microsoft to date
- 100% of Microsoft Office vulnerabilities reported in 2010
- 100% of Internet Explorer and 100% of IE 8 vulnerabilities reported in 2010
- 64% of all Microsoft vulnerabilities reported in 2010.
Peter Beauregard, director of program management for BeyondTrust comments for Help Net Security: “While the percentage of vulnerabilities mitigated by removing admin rights has dropped, the BeyondTrust survey does reveal an increase in overall vulnerabilities. Over the past five years, Microsoft has steadily improved operating system security, culminating in Windows 7, Microsoft’s most secure operating system ever.”
“Unfortunately, all platforms suffer from security vulnerabilities and as indicated by the recent Android issues, the more popular you are the more people are looking to find and exploit vulnerabilities. We expect Microsoft to continue to make progress but companies will still need to manage patches, keep up to date with their virus definitions and remove administrative privileges from their users,” he added.
The complete report is available here (registration required).
To learn more about patching challenges and techniques read our interview with Qualys CTO Wolfgang Kandek, where he offers his extensive knowledge on the subject.