In a Thursday presentation at RSA 2008 in San Francisco, David Cross, a product unit manager at Microsoft who was part of the team that developed UAC, admitted that Microsoft's strategy with UAC was to irritate users and ISVs in order to get them to change their behavior.
"The reason we put UAC into the platform was to annoy users. I'm serious," said Cross.
Microsoft not only wanted to get users to stop running as administrators, which exacerbates the effects of attacks, but also wanted to convince ISVs to stop building applications that require administrative privileges to install and run, Cross explained.
"We needed to change the ecosystem, and we needed a heavy hammer to do it," Cross said.
Keith Meisner, senior systems engineer at AppTech, a Tacoma, Wash.-based solution provider, says UAC has helped Microsoft improve end users' overall security posture.
"Many of the situations we deal with have to do with users being uninformed about threats on the Internet," said Meisner. "Are there some annoyances with UAC? Yes, but advanced users know how to get around them."
But while UAC is good for overall security, it does present logistical issues, said Steve Snider, president of Cadre Information Security, a Cincinnati-based solution provider. "For people working in an office, close to IT, it's not a problem, but when you have a very mobile workforce, and you have to load and update applications, that's when it becomes more of an issue," he said.
As a result of UAC, software vendors have changed their approach to developing software, to the point where fewer applications and tasks are triggering alerts, said Cross. "Most users, on a daily basis, actually have zero UAC prompts," he said.
Cross also disputed the popular notion that many frustrated users have decided to shut off UAC alerts entirely. He cited internal Microsoft research that shows 88 percent of all Vista users operate with UAC turned on, and 66 percent of sessions have no prompts, and number he says will continue to grow over time.
"UAC is not a perfect security boundary, but it [has helped us] move from 'zero click' exploits to 'one click' defense," said Cross.
related stories
Video
trending stories
sponsored resources

OutSystems
Modern Application Development 360

Symantec
Symantec Business Security Learning Center

HP Amplify™ - A Simplified Global Program for the Customer-Driven Digital Age
HP Inc.

BlackBerry
BlackBerry Learning Center

Dell Technologies
Dell Technologies Cloud Learning Center

Dell Technologies
Dell Technologies Storage Learning Center

NPD
Industry Trends 360

Comcast
Comcast Business Learning Center

Vertiv
Edge Computing 360

Sophos
Sophos Cybersecurity Learning Center

Products of the Year Showcase

Cysurance
Cyber Insurance 360

StorageCraft
Disaster Recovery Learning Center

APC by Schneider Electric
IoT Platforms 360

EPOS
EPOS

Smart 3rd Party
3rd Party Maintenance 360

WatchGuard
WatchGuard

Spectrum Partner Program
Spectrum Partner Program

ADT
Network Security 360

Tenable
Cyber Risk 360

Dell Technologies
Dell Technologies Hybrid Cloud Learning Center

Wasabi
Wasabi

Webroot
Webroot Learning Center

Dell Technologies
Dell Technologies Server Learning Center
