The study showed:
- 69% of all published vulnerabilities of any severity (106 of 154) could be mitigated by running as a standard user.
- 92% of Microsoft critical vulnerabilities (88 of 96) were mitigated
- 94% of Microsoft Office vulnerabilities were mitigated
- 89% of Internet Explorer vulnerabilities were mitigated
- 53% of Microsoft Windows vulnerabilities were mitigated
"Mitigated" does not mean that exploits are blocked completely. It's likely that in most of these cases an attacker of a less-privileged user could do some damage, like stealing data to which the user had access, but could not make an attack persistent; this means that he could not make it reload after the user logged out, and therefore once the user does so the attack is gone. This is a very important mitigation. For example, in the bulletin for a critical Excel vulnerability last December, in the "Mitigating Factors..." section, Microsoft states "An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights."
For home users and small businesses that aren't candidates for management software like BeyondTrust's, running as a standard user as opposed to Administrator is much more practical with Windows Vista than with XP or earlier versions of Windows.Originally posted to the PCMag Security Watch blog.