BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Kernel Versus User Mode? – It’s a Question of Security

Posted March 3, 2011    Peter McCalister

In the great debate of how to secure the desktop from the misuse of privilege, nothing is more contested then the approach: kernel versus user mode.  Every vendor will postulate on their approach as the best methodology for eliminating desktop admin rights and fostering a least privilege environment, but how do you separate the marketing BS from the technical realities?

Over the past 6 years that PowerBroker Desktops (FKA Privilege Manager) has been in themarketplace, BeyondTrust has invested a large portion of our R&D budget (more than some competitor’s entire annual revenue) making sure that the methods we use to elevate user privileges are the most secure.  To simplify the product we implement as much as we can at the user level, but to preserve the security integrity of the product, a small portion of critical functionality is implemented as a kernel driver.  This patent-pending functionality is implemented using methods supported by Microsoft and does not “patch the kernel”.  Most importantly, the functionality in the driver is critical for securing process elevation against several well known attack vectors.  Without this functionality, a user or malware can attack an elevated process and gain full control over the desktop, which defeats the whole purpose of managing user privileges.  To date, we know of no other way to protect against these attacks, and any solution without this type of driver component may be susceptible to security vulnerabilities.  In fact, we love to uncover these vulnerabilities and can offer you a free evaluation of your current environment.

This is not an argument about the merits of user mode versus kernel mode controls, it’s a matter of meeting our obligation to provide a secure, well engineered product.  Products that operate at the kernel level have the potential to introduce system instability if not properly implemented. But PowerBroker Desktops has been extensively tested,  including testing with Microsoft’s Driver Verifier  and we have never had any issues with stability on the over 1,000,000 (one million) desktops that are licensed to use our product.  In fact we also have been a Microsoft Gold Partner for years and securedWindows 7 Compatibility Certification in April, 2010.

Existing and potential customers of privilege elevation products should do their own research.  We are happy to put our products through any test or evaluation process you want and can help you assess the vulnerability of your current solution. Click on the button below for your own free evaluation or contact a rep now.

Leave a Reply

Additional articles

PBPS-screenshot-blog aug2014

Failing the Security Basics: Backoff Point-of-Sale Malware

Posted August 22, 2014    Marc Maiffret

At the beginning of this month, US-CERT issued a security alert relating to a string of breaches that had been targeting Point of Sale (POS) systems. The alert details that attackers were leveraging brute forcing tools to target common remote desktop applications such as Microsoft’s Remote Desktop, Apple Remote Desktop, Splashtop and LogMeIn among others….

Tags:
, , , , , ,

Troubleshooting Windows Privilege Management Rules with Policy Monitor

Posted August 21, 2014    Jason Silva

When defining and testing PowerBroker for Windows rules for production or pilots, customers sometimes tell us, “I don’t think this policy / program is working.” This is usually a case of the policy not properly triggering because of the way the rule was created. A unique feature of PowerBroker for Windows compared to other solutions is a client-side…

Tags:
, , ,
darren-mar-elia

BeyondTrust Webcast: Darren Mar-Elia’s 4 Active Directory Change Scenarios to Track

Posted August 20, 2014    Chris Burd

In our latest webcast, we joined Darren Mar-Elia, CTO at SDM Software, to discuss best practices for Active Directory (AD) change management. Here are some key takeaways from the presentation, followed by a link to a full-length video of the presentation. Mar-Elia kicks things off with a critical insight: that the best AD change management…

Tags:
, , , , , , ,