Environment: small engineering company (<50 employees) and everyone is local administrator on their computer, including everyone in the management group.
Setup: Some standard security features are in place: NGFW, (N)IDS, (H)IDS, DLP, segmented network, anti malware on each client, local FW, Windows update, automated third pary software updates on each client, lock out policy, OSSEC agents on all servers.
Problem: when malware hits (and it does!) infection is much worse when user is admin.
Sought solution: protect the VIPs in the management group from malware infection (or rather: malware infecting the entire computer). Since they are in high risk of being "spear fished"
First step is of course to make them standard users. So far so good, but they demand admin rights in case they need to (without calling helpdesk). I'm willing to give this to them in a transaction period but it can't be as easy as to give them a local admin account as well since they will most probably only use that account all the time. I'm thinking some kind of OTP solution or similar to give them a big enough hurdle to get over if they absolutely need to be admin. Suggestions?
I realize that malware infections will still be a problem for the engineering group but that's a future project.