Do Windows Users Follow the Principle of Least Privilege? Investigating User Account Control Practices Sara Motiee, Kirstie Hawkey, Konstantin Beznosov Laboratory for Education and Research in Secure Systems Engineering Department of Electrical and Computer Engineering, University of British Columbia Vancouver, Canada {motiee,hawkey,beznosov}@ece.ubc.ca ABSTRACT subject in a system be granted the most restrictive set of The principle of least privilege requires that users and their privileges possible for performing the task at hand. One practical implementation of PLP in operating systems is a programs be granted the most restrictive set of privileges 1 possible to perform required tasks in order to limit the dam- \least-privilege user account" (LUA), which requires users ages caused by security incidents. Low-privileged user ac- to use accounts with as few privileges as possible for day-to- counts (LUA) and user account control (UAC) in Windows day work on PCs [17]. To implement this approach, oper- Vista and Windows 7 are two practical implementations of ating system designers have developed various types of user this principle. To be successful, however, users must apply accounts and advise end users to employ low-privilege ac- due diligence, use appropriate accounts, and respond cor- counts for their daily tasks [17]. By following this approach, rectly to UAC prompts. With a user study and contextual users will be better protected from malware, security at- interviews, we investigated the motives, understanding, be- tacks, accidental or intentional modifications to system con- haviour, and challenges users face when working with user figuration, and unauthorized access to confidential data. accounts and the UAC. Our results show that 69% of par- While low-privilege user accounts enhance security, they ticipants did not apply the UAC approach correctly. All 45 have not been widely adopted. Indeed, during a Microsoft participants used an administrator user account, and 91% Financial Analyst Meeting in 2005, it was estimated that were not aware of the benefits of low-privilege user accounts 85% of PC users performed their daily tasks using adminis- or the risks of high-privilege ones. Their knowledge and ex- trator accounts [11]. One reason for the lack of LUA popu- perience were limited to the restricted rights of low-privilege larity is that many simple tasks (e.g., changing the system accounts. Based on our findings, we offer recommendations time when traveling, installing an application) can only be to improve the UAC and LUA approaches. done from an account with administrative privileges (\ad- min account" for short) [23]. It appears that users often choose the convenience of working with administrative priv- Categories and Subject Descriptors ileges over the reduction in risks associated with security H.5.2 [Information Interfaces and Presentation]: User breaches. Even though there is anecdotal evidence suggest- Interfaces|Evaluation/Methodology; D.4.6 [Software]: Ac- ing that mainstream operating systems support users poorly cess Controls|Invasive Software in following the PLP, there has been no published empirical data that could inform researchers and practitioners on the General Terms actual use of LUA and related mechanisms by users. The overarching goal of our research is to investigate how Human Factors, Security well mainstream operating systems for personal computers support users in following the PLP, and what can be done Keywords to improve such support. Our particular objectives are to Usable security, least privilege principle, least privilege user determine (1) how well users are aided by the technology to account, user account control follow this principle, (2) what challenges they face, (3) what factors motivate their behaviour, and (4) what are the areas 1. INTRODUCTION of potential failure for current PLP mechanisms. For the initial study which we report in this paper, we nar- To limit damages from security breaches, the \principle rowed the scope of our research to Windows Vista and Win- of least privilege" [16], or PLP for short, requires that each dows 7. In addition to LUA, Windows Vista introduced user account control (UAC) [23], which was intended to make the use of LUAs more convenient and therefore reduce incen- tives for violating PLP. With UAC, all users, including local administrators, can work with non-administrative privileges Copyright is held by the author/owner. Permission to make digital or hard when such privileges are not necessary. A UAC prompt is copies of all or part of this work for personal or classroom use is granted raised when one of the user's processes requires adminis- without fee. Symposium on Usable Privacy and Security (SOUPS) 2010, July 14–16, 1 2010, Redmond, WA USA Since LUAs may not necessarily be least privileged, we refer . to them as \low-privilege user accounts". 1 trative privileges (e.g., when installing software or changing pose and benefits of both UAC and LUA to users through system settings). UAC was revised in Windows 7 to reduce the interface itself, rather than only through the technical the number of prompts by default and to allow users to cus- documentation from the OS vendor. Furthermore, either tomize which prompts they receive. If UAC is disabled,2 the users should be made aware of the the distinction between type of user account determines whether the PLP is followed UAC and other security-related mechanisms (e.g., personal (in case of a non-admin account) or not (in case of an admin firewall, anti-virus software), or UAC should be integrated account). However, if UAC is enabled on a user's system, with the other mechanisms. In addition to the admin ac- it is not critical what type of user account is in use; as long count created upon installation of the OS, users should be as the user responds to UAC prompts correctly, the PLP provided with an initial, default, low-privilege user account is followed. Given this interdependency between LUA and and be encouraged to use it for their daily work. How- UAC and the critical role of the two in the support for the ever, to ensure users continue following LUA, users must PLP, we studied the behaviour of users in employing LUA be able to conveniently apply modifications on their PCs as well as in responding to UAC prompts. from within that low-privilege account. Furthermore, UAC To this end, we conducted a laboratory study, followed by prompts should be raised consistently, in selective and lim- contextual interviews. We recruited 30 Windows Vista and ited situations so that users do not ignore them due to habit- 15 Windows 7 users in order to observe any changes in their uation. These prompts should communicate enough infor- behaviour according to the different UAC implementations mation about their purpose and functionality so that users on these Windows platforms. None of the demographics of can respond correctly. our WV and W7 participants were statistically significantly In the remainder of the paper, we first discuss related different, except for the years of experience with the oper- work and background information about the mechanisms of ating system. The participants had a wide range of educa- applying PLP in Windows Vista and 7. We then describe tional levels (from high school to Masters) and the 16 (out the methodology of our study and its results in Sections 3 of 45) non-student participants had a variety of occupations. and 4, respectively. Section 5 provides a discussion of our To maintain ecological validity, we asked all participants to results, as well as recommendations for applying PLP. We perform study tasks on their Windows laptops. discuss the limitations of our study and outline future work It was perhaps shocking, but not surprising, to find every in Section 6 and conclude the paper in Section 7. single participant performing day-to-day activities on own their laptop using an admin account. To better understand 2. BACKGROUND AND RELATED WORK the factors affecting the use of LUA approach, we asked The aim of our research is to investigate whether users the study participants to complete a user account creation follow the PLP and how well the technology supports them task, and we probed their knowledge about LUA. Although in following this principle. We first present related work on most created an appropriate low-privilege user account in applying this principle. We then provide background about the study task, participants were not motivated to employ the UAC approach of Windows Vista and 7. As the UAC a low-privilege account for their own daily computer usage. approach is based on raising warning messages, related work Furthermore, 91% of participants did not understand the on warning messages is also discussed briefly. security risks of high-privilege accounts or the benefits of low-privilege ones. In addition to a lack of awareness of 2.1 The principle of least privilege security risks, prior experience with the inconvenience of Different mechanisms have been implemented for apply- low-privilege user accounts in different contexts of prior dis- ing the PLP. One main category of mechanisms is the user couraged participants from using such accounts. account model offered by various operating systems. There To investigate the use of the UAC approach, we asked are various types of user accounts with different privileges. participants to complete a set of tasks that raised legitimate In Unix-style operating systems, the root account has full and fake UAC prompts to observe their response behaviour. privileges, while a non-root or basic account has limited priv- Our results show that at least 68% of participants did not ileges. It is considered bad practice to use the root account use UAC approach correctly. These were participants who for daily use, as simple typographical errors in commands either disabled UAC (20%) or consented3 to a fake random, can cause major damage to the system [12, 5].