|
[TABLE]
[TABLE]
[TABLE]
[TABLE]
[TABLE]
You can even specify which privileges or special powers a service can have (shutdown, audit, etc.), so malware doesn't have access to all the default privileges of the account under which the compromised service is running.
Further, services now have a unique security identifier (SID), so they can no longer run under the radar. In previous server OSes, a service would run anonymously under the context of the service account it was configured to use, such as LocalSystem, giving the service extensive privileges on the local computer. T
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
hat meant you could only apply an Access Control List (ACL) against the service account--generally not a practical solution--not the actual service, essentially giving administrative control to an anonymous entity. With unique SIDs, ACLs can be applied to specific services for tight control.
This can be taken a step further by applying a write-restricted token to the service process. Write attempts to resources that do not explicitly grant the service SID access will fail.
|
