BeyondTrust has announced version 4.0 of its flagship Privilege Manager product. The new version is designed to make managing security in Windows Vista easier.
Privilege Manager 4.0 lets enterprises eliminate local administrator rights while allowing users to run all authorized applications by transparently granting administrative privileges to only the specified applications that need them.
It also lets IT set the integrity level of an application process to create an enhanced Least Privilege security environment, and has on-demand capabilities that let authorized users elevate the privileges of applications not previously specified.
It does this by leveraging Active Directory’s Group Policy, and BeyondTrust says this is the first product to have this capability.
Privilege Manager 4.0 also gets rid of what can be annoying dialog boxes that crop up when Vista’s User Account Control (UAC) security is implemented.
Another new feature lets IT define rules to provide elevated privileges to applications with digital certificates signed by specified software publishers. The idea here is to make it faster and easier for administrators to create rules for software from trustworthy sources.
Further, Privilege Manager 4.0 includes a new rule to elevate software installation privileges from specified or authorized CDs or DVDs.
What It All Means
Integrity levels are assigned to every process, user and object in Vista, and an object can only interact with another of the same or a lower integrity level.
By default, Vista runs applications at a medium integrity level, and Privilege Manager lets users set the integrity level of processes.
“You could, for example, tell Vista to run Firefox at a low integrity level so any piece of malware or anything that can leverage that process won’t be able to run,” Scott McCarley, director of marketing at BeyondTrust, told InternetNews.com.
By providing an on-demand elevation rule, Privilege Manager eliminates the need for systems administrators to log in as local administrators onto users’ desktops.
This reduces security headaches because “a lot of spyware and malware requires administrative privileges in order to install, and they can turn off certain systems or disable security products such as your firewall if they get those administrative rights,” McCarley explained.
But, if local users get on-demand capabilities to elevate the privileges of previously unspecified applications does that mean they won’t have to go to system administrators for help? Yes, but “that lets users run without administrative rights yet still do all the activities they need to do to complete their jobs,” McCarley said.
For example, users may need to be able to self-manage tasks like installing approved ActiveX controls or defragging their hard drives.
Also, it’s difficult to predict when certain types of users, such as traveling laptop users, system administrators and developers, will need elevated privileges, as, by the nature of their jobs, “they may need to install or run an application they previously didn’t have to,” McCarley said.
It was difficult to create a policy covering such ad hoc requirements, and, with Privilege Manager 4.0, BeyondTrust has introduced new rules to cover the unpredictable requirements of such users.
Doesn’t that open up new security holes? Not at all: “You could designate one systems administrator or a group of systems administrators to be allowed to run a process with elevated privileges at their discretion, but they’d be prompted for passwords and required to provide a text justification,” McCarley said.
Page 2 of 2
All this will be logged for auditing purposes, and “you’ll have a record of every instance of every process they ran with elevated justification and you can review that and read their text justification,” McCarley added.
Microsoft Group Policy comes with Active Directory servers, and using it to manage integrity levels in Vista lets Privilege Manager 4.0’s users “centrally manage and create policies using existing infrastructure and not have to learn new management tools,” McCarley said.
“We just snap into Group Policy and don’t make any schema changes to Active Directory,” McCarley said.
The Analyst’s Take
Privilege Manager 4.0 “makes it possible to take some of the security features of Vista and extend them to third party applications that Microsoft didn’t provide,” said Dan Blum, senior vice president and principal analyst at the Burton Group.
Vista “offers better opportunities for an organization that can control the settings and the way a desktop is configured to have a higher bar for security,” he added.
Leveraging Microsoft Group Policy is a good idea because “a large percentage of organizations have an Active Directory domain to which they join their computers, and they’d use Group Policy to tailor aspects of the desktops’ configuration,” Blum said.
But will it all be worthwhile in light of Vista’s poor acceptance among users? That’s a tough one: “Vista is underperforming from what I’d expected; I thought it would take until 2010 for it to achieve critical mass but I wonder if it might even take a year longer than that,” Blum said.
Other Privilege Manager Information
Privilege Manager users include Liberty Mutual, Boston University, KPMG, HP, Paychex (NASDAQ:PAYX), Verizon Wireless (NASDAQ:VZ), the U.S. Postal Service, the U.S. Air Force, and the U.S. Army.
BeyondTrust Privilege Manager 4.0 is available now, at $30 a seat. Current users of earlier versions will be upgraded as part of their upgrade assurance program.