Scorpion Software Corporate Weblog

February 15, 2005

Understanding Least Privilege

The idea that the principle of least privilege requires that a user or process be given no more privilege than necessary to perform a job makes a lot of sense in this hostile digital divide we live in. Least privilege has become a passion of mine, and its reflected in everything that I design now adays. Which is why Carina works so well in the face of hostile and malicious code.

In today's show I talk about the security principle of least privilege, how we use it to protect our customer's information... and how you can use it to protect your desktops.

For more information about least privilege please check out some of these links:

• nonadmin.editme.com - This is a community web site (wiki) for Windows users who want to learn how to run without Administrator privileges, and why they should do this.
  
• "RunAs" basic (and intermediate) topics - Aaron Margosis' introduction on how to use the runas command in Windows
  
• Secure Coding Practices: Running with Least Privileges in Windows - An older article I wrote for CodeProject on how to develop using least privilege on Windows
  
• Developing Software in Visual Studio .NET with Non-Administrative Privileges - Lars Bergstrom's great article that explains how to productively develop software while logged on with non-administrative privileges.
  
• Using a Least-Privileged User Account - A small article on TechNet discussing LUA, and how it will affect LongHorn.

After listening to customer feedback, we are going to try a new format with this podcast. We will keep these single topic recordings short (somewhere around 5 minutes) so that people with busy schedules can still get a chance to listen to it. We will leave longer shows for more in depth interviews etc. Please let me know if you like the new format.

Think strategically. Protect your information. Enjoy!

MP3: Scorpion Vault: Understanding Least Privilege (4:59s / ~4.7mb)

Posted by Dana Epp at 07:29 AM | Comments (0) | TrackBack

February 07, 2005

Understanding the Window of Exposure

In my first podcast ever here at the company, I thought I would introduce some of you to the concept of the "Window of Exposure" and discuss how intrusion prevention products like Carina fit in comparision to current security products. The timeline graph below depicts the positioning of Carina against many of these products. You can find more information about this within the podcast.

I apologize for the quality of the recording. I need to spend some time learning from Adam Curry on how to make a cleaner cast without the popping sounds from the microphone. He has plenty of information on sound quality and I will need to look into that. It should get better in the coming months in future podcasts.

Anyways, if you are using a PodCast-enabled aggregator, this feed has full enclosures and should be picked up by audio.weblogs.com. Enjoy.

MP3: Scorpion Vault: Understanding the Window of Exposure (11:38s / ~11mb)

Posted by Dana Epp at 03:59 PM | Comments (0) | TrackBack