A third-party wants to provide a web app which they say only works if we enable unsigned ActiveX (unfortunately users are required to use IE). I understand what 'signing' is, as well as the basic impacts could be if we run unsigned software, such as having client-side code being execute on the browser.
My questions are:
Is this acceptable, first of everything, from a security standard (i.e. accepting an unsigned software)?
Does the fact that none of our users have admin privileges on their machines mitigate the risks of running unsigned software?
Is it possible to allow the unsigned ActiveX only for that software, but not for everything else?
Does 'being signed' really mean more secure? I mean, it's signed, so what?
Any pointers to further reading would also be much appreciated.