Free Privileged Account Discovery Tool: Identify & secure credentials to stop lateral movement. Download Free

BeyondTrust
  • Products
    Privileged Password Management
    Discover, manage, audit, and monitor privileged accounts
    Password Safe DevOps Secrets Safe
    Endpoint Privilege Management
    Manage privileges on Windows, Mac, Linux, and Unix endpoints
    Windows and Mac Unix and Linux Active Directory Bridge
    Secure Remote Access
    Centrally manage and secure remote access for service desks and vendors
    Remote Support Privileged Remote Access
    BeyondInsight Analytics
    See All Solutions
  • Resources

    Universal Privilege Management

    Our innovative Universal Privilege Management approach secures every user, asset, and session across your entire enterprise.

    Watch Video

    Learn

    Case Studies
    Competitor Comparisons
    Datasheets
    Glossary
    Product Demos
    Whitepapers

    Attend

    Events
    Go Beyond
    Training
    Webinars

    Support

    Changelog
    Professional Services
    Technical Documentation
  • Blog
  • Partners
  • Contact
  • Support
  • Services
  • Training
  • Events
  • Company

Kernel Versus User Mode? - It’s a Question of Security

March 3, 2011

  • Blog
  • Archive
In the great debate of how to secure the desktop from the misuse of privilege, nothing is more contested then the approach: kernel versus user mode. Every vendor will postulate on their approach as the best methodology for eliminating desktop admin rights and fostering a least privilege environment, but how do you separate the marketing BS from the technical realities? Over the past 6 years that PowerBroker Desktops (FKA Privilege Manager) has been in themarketplace, BeyondTrust has invested a large portion of our R&D budget (more than some competitor's entire annual revenue) making sure that the methods we use to elevate user privileges are the most secure. To simplify the product we implement as much as we can at the user level, but to preserve the security integrity of the product, a small portion of critical functionality is implemented as a kernel driver. This patent-pending functionality is implemented using methods supported by Microsoft and does not “patch the kernel”. Most importantly, the functionality in the driver is critical for securing process elevation against several well known attack vectors. Without this functionality, a user or malware can attack an elevated process and gain full control over the desktop, which defeats the whole purpose of managing user privileges. To date, we know of no other way to protect against these attacks, and any solution without this type of driver component may be susceptible to security vulnerabilities. In fact, we love to uncover these vulnerabilities and can offer you a free evaluation of your current environment. This is not an argument about the merits of user mode versus kernel mode controls, it’s a matter of meeting our obligation to provide a secure, well engineered product. Products that operate at the kernel level have the potential to introduce system instability if not properly implemented. But PowerBroker Desktops has been extensively tested, including testing with Microsoft’s Driver Verifier and we have never had any issues with stability on the over 1,000,000 (one million) desktops that are licensed to use our product. In fact we also have been a Microsoft Gold Partner for years and securedWindows 7 Compatibility Certification in April, 2010. Existing and potential customers of privilege elevation products should do their own research. We are happy to put our products through any test or evaluation process you want and can help you assess the vulnerability of your current solution. Click on the button below for your own free evaluation or contact a rep now.

Scott Lang

Sr. Director, Product Marketing at BeyondTrust

Scott Lang has nearly 20 years of experience in technology product marketing, currently guiding the product marketing strategy for BeyondTrust’s privileged account management solutions and vulnerability management solutions. Prior to joining BeyondTrust, Scott was director of security solution marketing at Dell, formerly Quest Software, where he was responsible for global security campaigns, product marketing for identity and access management and Windows server management.

Stay Up To Date

Get the latest news, ideas, and tactics from BeyondTrust. You may unsubscribe at any time.

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

You May Also Be Interested In:

Webcasts | February 09, 2021

Customer Webinar: Remote Support 21.1 Released!

Webcasts | February 24, 2021

Your PAM 2021 Blueprint: Securing Privileged Accounts for On-Premises and Cloud Assets

Whitepapers

Evolving Privileged Identity Management (PIM) In The 'Next Normal'

BeyondTrust Logo
  • Facebook
  • Twitter
  • LinkedIn

Keep up with BeyondTrust

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

Customer Support
Contact Sales

Products

  • Endpoint Privilege Management
  • Password Management
  • Privileged Remote Access
  • DevOps Secrets Safe
  • Remote Support

Resources

  • Blog
  • Case Studies
  • Competitor Comparisons
  • Datasheets
  • Glossary
  • Videos
  • Webcasts
  • Whitepapers

About

  • Company
  • Careers
  • Contact
  • Events
  • Leadership Team
  • Partner Program
  • Press

Languages

  • English
  • German
  • French
  • Spanish
  • Korean
  • Portuguese
  • Japanese
  • Privacy
  • Security
  • Manage Cookies
  • WEEE Compliance

Copyright © 1999 — 2020 BeyondTrust Corporation. All rights reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust Corporation is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.