Mitigate Operational Risk: Service Control in Privilege Guard 3.8

Privilege Guard becomes the only privilege management solution to provide control of Windows Services

Services play an integral part of endpoint functionality - they are components of many desktop products, and almost all server implementations. On desktops, services run in the background across multiple user sessions, most commonly for products such as antivirus, firewalls and other security products. On servers, many roles function as services because of the performance and high availability requirements of applications in the datacenter.

In addition, many native features of Windows run as background processes, and are enabled or disabled from its service.

So it's a fair assumption that no matter your role within the organization, at some point there may be a need to interact with a service, and herein lies the issue.

Unavoidable risk

Services are typically accessed through the Services.msc management console, Task Manager, or from the net.exe command line. Other 3rd party tools offer extended functionality for managing services. But one thing in common is that managing services (with a few exceptions) requires administrator privileges. Granting those privileges to the application is great if you want your user to have access to ALL services, but what if you need a bit more control? Access to services should be restricted to only authorized personnel - the people responsible for what they deliver to an organization. Put it another way, services should be out of bounds.

Power users, particularly developers, frequently need to be able to start and stop services on their own PC’s - for example, a web developer running code in IIS (a service). Elevating Services.msc lets the developer do this, but also allows them to tamper with and disable other services.

Many server roles, such as databases, web servers, file servers, directory servers, etc run as services, and many scheduled/unscheduled maintenance tasks require access to those services. Given that servers tend to be business critical, maintenance is usually restricted to key teams or individuals responsible for their function. But servers are still a Windows OS, and may be maintained by multiple teams. As an example, a web server hosting an intranet may need to be accessed by the web team, the network operations team and also the security team. Roles within IT may be well defined, but when it comes to maintaining services, the boundaries are a lot less defined and usually unrestricted.

These are precisely the challenges that Privilege Guard 3.8 solves.

Granular control over service privileges

With Privilege Guard 3.8, you can now assign granular privileges for individual services, to whoever and wherever they are needed. Individual actions like start, stop or pause, can be elevated or revoked, and detailed auditing tracks all user interactions, whether allowed or blocked.

Assigning privileges to individual services eliminates the need to elevate high risk applications such as Services.msc or net.exe. Instead, these tools can be executed with standard rights, letting the user, developer or IT admin perform authorized tasks seamlessly.

For high risk or critical services, you can incorporate End User Messages to specific actions, prompting the admin for credentials or Challenge / Response authorization before being allowed to proceed. Where privileges are required, request messages are audited, and those requests can then be fed directly into policy for rapid provisioning of service privileges.

For environments were external contractors or consultants need to access services, add dual-authentication controls to ensure all actions are supervised and federated.

Avecto are the leaders in privilege management, and our award winning solutions help solve real challenges by removing admin rights from users. Privilege Guard is the first and only least privilege solution that lets power users and IT admins manage services in a secure, controlled and flexible standard user session.

Introducing Defendpoint

Edit: Privilege Guard has now evolved into the brand new security suite, Defendpoint, which encompasses Privilege Management, Application Control and Sandboxing. For more information, please visit www.avecto.com/defendpoint.