Company offers boost for Vista security

A security vendor is offering an add-on product for Windows Vista's User Account Control feature, which has been flagged as a threat to business users because it can be easily bypassed by hackers.

BeyondTrust's Privilege Manager 3.0, which will be available on March 19 and costs $30 per user, protects enterprise desktops running Vista with User Account Control in two major ways, said John Moyer, CEO of BeyondTrust.

First, it grants elevated privileges to certain applications and functions transparently to end users, instead of involving them in the process with dialogue boxes, he said. Hackers can use these dialogue boxes to trick users into unknowingly allowing malicious code to run on the machine.

Security vendor Symantec recently released research that outlined some of Vista's security holes and listed User Account Control as one of them for the reason Moyer outlined. Microsoft has said it is evaluating Symantec's research about Vista and will take steps to fix any vulnerabilities in the OS.

Microsoft included User Account Control in Vista to add security by limiting the access individual users have to applications or functions. While this is an enhancement for home users, it presents a security problem for business users because in order to access certain applications that are beyond the scope of their limited privileges, they must set up and use administrator passwords to set higher access rights, Moyer said. These dialogue boxes that ask them for passwords provide a way for hackers to get in, he said.

The second feature of Privilege Manager that helps prevent intrusion through User Access Control gives IT administrators centralized administration of setting the elevation of privileges for users, even though Privilege Manager itself runs locally, Moyer said. BeyondTrust's application connects to the group policy features of Vista to allow for this type of administration, he said.

BeyondTrust spun off from Desktop Standards, a company which Microsoft announced it had purchased on Oct. 2. Twenty employees of DesktopStandard took the Policy Maker Application Security product and became BeyondTrust. That product later was rebranded Privilege Manager, Moyer said.