Less Privileges is a good thing when it comes to computer security.
In Windows and other operating systems right management is assigned on a user basis.
This means that every software element that runs on your pc runs in the security context (rights/privileges) of the user who ran it.
Every time a user runs a program Windows checks and applies the rights of that user to the program that is running.
If the user rights are limited then the software that is running under that user is limited to what it can do on your pc.
If the user is omnipotent, the software is omnipotent and hence can do what ever the heck it feels like including, but not limited to, deleting all your precious family photos which you have been contemplating on backing up in the past 6 month but didn’t get to do it.
This means that when we want to control the rights of a software element on a pc we need to assign the act of running or executing this software to a specific user. This user’s rights will determine what the software can or cannot do.
Applying the least privilege principle would mean that this user should only have sufficient rights that are needed for the normal operation of the software we want to run.
Each new flavor of windows has a slightly different approach and mechanisms to tame rouge software elements.
In this article I will show you ways to control software privileges under the Windows XP operating system although similar methods exist in other versions of Windows.
The full scope of right management in Windows is beyond the scope of this article and if you would like to learn more on this subject there are plenty of resources on the web.
In Windows XP there are 2 simple methods we can use to enforce right management.
- Use Limited Privileges User accounts.
- Selectively Run Software under Limited Privileges User accounts.
Creating and Using Limited Privileges User accounts
By default when you receive you’re spanking new Windows XP machine or even if you were brave enough to install it yourself; Windows XP creates one administrative user account.
The administrative account is the dreaded omnipotent super user account that can be used to do any thing you want on your pc.
This account is needed for installing many types of software and hardware on your machine and you need to have at least one such account on your pc.
But you should remember that this account has the power wreck havoc on your machine and this is why it should be used sparingly.
<<< Page 1 Page 3 >>>
|
|
