Yes, Local Administrators ARE a Risk

Modern environments are in a constant state of flux; new systems are being commissioned, and old systems decommissioned, to meet new requirements and increase efficiency in all sectors. Managing those changes takes strategy and labour, and every change has an overhead in both of those resources.

What do you do when your users want new software, or to be able to update their apps without waiting for the next patch window?

It’s the perfect solution, your users can now:

• Install new and updated software
• Change software configurations
• Run repairs on software of there are issues
• Run software that only runs as a local administrator

And all this without taking up IT resources for changes that may only affect a single endpoint. Sure, everyone needs email but how many users need software for CAD, tax reconciliation, or even software development?

Many businesses decide that the cost to the business, and frustration of users, is too high and provide admin access to users over their own machine. Some may even give functional groups admin to all the endpoints in their team via security groups.

Whatcha Running There, Bud?

A significant downside of this strategy is loss of both control and visibility over endpoints. You don’t have to patch applications now, but are your users doing it? Maybe they’ve installed chrome and they’re keeping it up to date, or maybe they’re using a portable Firefox on a USB they bring from home – the same one they use to clean up viruses on their parents’ home PC.

If you’re letting users install their own software, answering these questions is going to be hard:

• What software do we monitor for updates?
• What software do we have installed in our environment?
• Are users using pirated software?
• Are users installing software from reputable sources?
• How do we get notified of vulnerabilities in a timely manner?

But how do I secure it?

Let’s have a look at ACSC’s Essential Eight Controls to mitigate exploitation. These are the Australian Government’s recommendation for the 8 most important controls to protect your business.

Let’s see how they align with allowing:

1. Application Control – Stringent Application Control is a great control is you have a single application that requires admin execution, but it is impossible for unmanaged endpoints. Application Control can only have an effective implementation if you can manage and restrict the use of the endpoint; local administrator privileges actively work against this control.
2. Patch Applications – If we are allowing users to install applications, there is no way to effectively implement a patching strategy. We don’t know what we need to patch.
3. Configure Microsoft Office Macro Settings – This is something we can do, but care should be taken to ensure that users aren’t able to undo group policy settings.
4. User Application Hardening – As with Patch Applications, we can’t implement this as we can’t control what applications are installed on an endpoint.
5. Restrict Administrative Privileges – Users have admin, the best we can do is restrict their scope to machines specifically assigned to them.
6. Patch Operating Systems – Not affected, though a policy should be enforced configuring the update schedule (disabling update checks is an administrative privilege)
7. Multi-factor authentication – Local Administrators can add local users to their machines which may bypass this policy
8. Regular backups – this is still possible, but backups must be configured centrally to prevent unrecoverable destruction on endpoints via deletion of filesystem checkpoints.

At this point, allowing Local Administrator access has weakened or invalidated the most effective controls we have.

OK, so we’ll get EDR to detect malicious activity. At least this way attackers can’t use tools to exploit other machines.

Oh, yeah that. We can’t stop the tools from running because we can’t get visibility and execution control within a virtual machine. Ok, we’ll get a vulnerability scanner to detect exploitable vulnerabilities – even if we can’t control the applications, we can scan for vulnerable installs to fix.

Oh, we made the scanner service a domain admin to have one account to scan all our machine. Now we need privileged account management anyway to detect and prevent the scanner account being used outside scanning schedules.

Conclusion

The basic answer here is – administrative privilege is a risk. One of the best ways to prevent exploitation is to limit its usage for administrators, any expansion pollutes your environment.

Giving users administrative access is giving away your control, and it’s hard to get that back.