Unfortunately what is coming up are applications that insist on installing themselves under Admin so they can install their background programs that will be receptors for future attack vectors... None of this is to contradict your recommendation to seperate one's daily user account from admin. That is still good practice and just wish more applications didn't fight it.
Welll... yeah. Most software should be installed as admin. If you trust the vendor, then, by all means, log in as admin (or provide the admin creds) to do the install. After install, you return to your regular user account. This is how it's supposed to work.
If you encounter an app that
runs only if you (the regular user) have admin permissions, that is bad, bad, bad. Quit, Uninstall, Clean up after, and if you paid for it, get your ******* money back.
"Their background programs" aren't necessarily attack vectors,
merely potential attack vectors - same as software in the foreground.
Here's the thing: There is no such thing as risk avoidance; there is only risk management.
You evaluate software features, methods, reputation, security history, price... and decide what is worth the risk. In an enterprise environment, typically, a team of engineers makes the decision for you. For example:
- Free Zoom was banned at the TLA (three letter agency) where I worked years ago. I designed a specific scanning process (using Tanium) to hunt it down and delete it, even if the user installed a "Runtime User Mode" version and changed its name. I heard Zoom improved their posture later.
- On the other hand, costly Microsoft Office is as solid a citizen as one can reasonably expect. The apps are arguably best in class. They have security precautions in place. Microsoft patches regularly. I install/patch MS Office by providing admin permissions when needed, but use the software in my normal user account.
- Meanwhile, I find Adobe kinda dodgy. The apps are arguably best in class, but I believe Adobe tends to ignore/deny security issues, and slow to remediate. I install/patch by providing admin permissions when needed, but use the software in my normal user account.
- Apple's apps are useful because they're laterally integrated across device platforms, for better or worse. Apple does security patching, but they feel stonewally and clumsy. Again, I provide admin creds when necessary because my agency deploys and manages Apple Mobiles, and my family settled on them as well.
Every app and web site, from every vendor, should be considered a risk to manage. If you're not worried, you're not paying attention. This degree of vigilance can be exhausting and expensive.
