Skip to main content
117 votes
Accepted

Does removing a GUI from a server make it less vulnerable?

Removing the GUI is useful and recommended. It will remove unused components, a lot of libraries, and makes the install size smaller. How does this make it less vulnerable? Fewer components equal ...
ThoriumBR's user avatar
  • 54.5k
116 votes
Accepted

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

Here's one data point from a software company that has an interest in security. I know this is common in similar organisations. There is a number of networks. They are physically separated and ...
Joe's user avatar
  • 1,294
95 votes
Accepted

How secure is RDP?

I believe that Teamviewer is a proxy service for tunnelled VNC connections. Hence, the first security consideration with regard to that service is that it is MITM'ed by design. There have been ...
symcbean's user avatar
  • 18.7k
72 votes

How secure is RDP?

Edit: According to the comments there seems to be combination of configuration options in the enterprise edition of TeamViewer which might reduce my concerns. Since I have never used those, I cannot ...
H. Idden's user avatar
  • 2,978
71 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

In my experience, it is common for developers to have admin access on their own machines. It is also common for them not to have admin access on their own machines. However, in the latter situation ...
Joel Coehoorn's user avatar
48 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

I work for a fairly large investment management firm (~6000 employees) and developers are one of the groups that we approve for local admin access. We tell them not to install any software, as that is ...
Justin's user avatar
  • 712
42 votes

Does removing a GUI from a server make it less vulnerable?

Removing the GUI also has the side effect of making it a bit more "human safe" because put bluntly, it makes the OS more idiot proof. There are countless stories of small businesses having users ...
Allison's user avatar
  • 4,025
36 votes

How secure is RDP?

In addition to the other great answers, TeamViewer offers less physical security because it requires that the screen is unlocked in order to facilitate a remote session. That is, anyone walking past ...
SilverlightFox's user avatar
36 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

In my experience allowing and disallowing local admin access is common, just as common as dirty workarounds for the latter. - So you should ask yourself: Which threat to your network is made worse by ...
Falco's user avatar
  • 1,502
31 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

In my career, with rather small companies (less than 100 people), we always had local admin rights. We either have real desktop machines which are maintained by IT, but got the rights, or we were ...
Marcel's user avatar
  • 4,093
29 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

In a rather small department of a larger organization (~100 in department, ~3500 in full organization) we chose an in the middle solution: sysadmins had 2 accounts, one (non administrator even for ...
Serge Ballesta's user avatar
26 votes

How secure is RDP?

To begin, I know nothing about TeamViewer, so I won't attempt to comment on it. Historical RDP servers used "RDP Security", which is indeed a broken protocol and vulnerable to MITM. Don't do that. ...
Daniel Bungert's user avatar
25 votes
Accepted

Is local admin access a danger to a properly set-up network?

Local Admin access means that it is easier for the attacker to establish persistent control of the host, to install software and modify system settings, and to take actions like sniffing the network ...
gowenfawr's user avatar
  • 72.9k
17 votes

How secure is RDP?

Assuming that you're using a modern version of RDP and configure it correctly (e.g. enable NLA, sort out proper certificates) the main risk of exposing it directly to the Internet tends to be the ...
Rory McCune's user avatar
  • 62.4k
13 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

In my experience working for larger organizations, it is absolutely not common for developers to have full rights to anything other than development specific resources. It seems like your organization ...
John-M's user avatar
  • 251
11 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

First of all you need to learn that it does not matter what "is common" or "typical" because: typically such situations are handled horribly. You are making the best case for this statement. If ...
Tom K.'s user avatar
  • 7,966
11 votes

Is local admin access a danger to a properly set-up network?

Danger is a bit of a strong word. I would say that local admin access presents additional network risks over non-admin access. Admin access allows the user to run a packet sniffer in promiscuous ...
Steve Sether's user avatar
  • 21.6k
10 votes

How secure is RDP?

I'll expand on Daniel Bungert's explanation of protocols involved and why they work together. Having written a MitM proxy for RDP, I'm very familiar with the inner workings of most protocols involved. ...
Jean-Bernard Pellerin's user avatar
10 votes
Accepted

Is an updated OS, in general, more secure than its predecessor?

Patching addresses known risks while introducing unknown risks, like new unknown vulnerabilities, bugs, performance issues, etc. That's why places like banks wait a while to quantify the unknowns ...
schroeder's user avatar
  • 131k
9 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

This fundamentally depends on context, and in particular on your threat model. In some organisations, it's common to give developers complete control over their development workstation, to the point ...
James_pic's user avatar
  • 2,580
9 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

The problem you actually have is competent IT are attempting to enforce a boneheaded rule. You really only have one choice, give developers effective admin access. I keep seeing the same advice being ...
Joshua's user avatar
  • 1,146
8 votes
Accepted

How to specifiy -CAPath using OpenSSL in windows to perform TLS handshake

#Use someone else's PEM bundle. You can not use the Windows certificate store directly with OpenSSL. Instead OpenSSL expects its CAs in one of two ways: Many files: In a special folder structure. One ...
StackzOfZtuff's user avatar
8 votes

How secure is RDP?

I'd go with some kind of VPN from the user's remote computer to a firewall at work, and then run RDP over that encrypted link. Problem with leaving a port open is that eventually it is found, and you'...
Criggie's user avatar
  • 522
8 votes
Accepted

How can we beef the security of our Windows Server 2012 R2 against ransomware?

The basics for protection against ransomware is : Update frequently (OS, AntiVirus, ...) Don't open phishing / infected emails which usually convey the ransomware (user awareness) Backup, backup, ...
M'vy's user avatar
  • 13.1k
8 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

I've seen two approaches that work. Give developers admin access to their machines. This is the easiest and most common approach. It is usually the best choice Create a team in the organisation whose ...
UEFI's user avatar
  • 222
7 votes

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

I worked for some time for a company that really believes in security (or so they think). Every once in a while they would organize a social event, like playing bowling. Joining was free, but you had ...
Fabio says Reinstate Monica's user avatar
6 votes

How secure is RDP?

This started as a comment. It's important to point out the "Who's at fault question". If you use a third party service and they fail to provide it's their failure to provide. If you use something in ...
coteyr's user avatar
  • 1,556
6 votes

Is local admin access a danger to a properly set-up network?

It is far more danger than most people guess. When we debated how much someone could do from Local Admin (local account, not domain account) on one domain-joined machine, I said "Would you like ...
Joshua's user avatar
  • 1,146
5 votes
Accepted

Windows Server 2012R2 -> Trusted Root CA Store (Local Computer) not listed in SERVER HELLO / CERTIFICATE Request filed of TLS1.2 handshake

Expected behavior on Win2012. Leave as is, or force via registry. I have never configured client cert auth on any IIS but I think I found out what's wrong here: "SendTrustedIssuerList" ...
StackzOfZtuff's user avatar
5 votes

How can I track executed PowerShell commands within a network?

PowerShell Script Block Logging might be useful. I haven't tried it yet, so I don't know how you can track user information, but it surely tracks the executed commands. Here's a link to Microsoft Docs ...
PatrikN's user avatar
  • 163

Only top scored, non community-wiki answers of a minimum length are eligible