Admin Rights are not Human Rights

The talk argues that reactive defenses such as anti-malware can no longer keep pace with the volume of new malware, so proactive controls matter more. The speaker places inventory and application control at the foundation, since you cannot protect what you have not catalogued, and notes that application control is undermined whenever users hold administrator rights.

The core of the session is a live demonstration on a Windows 10 LTSC machine. Starting from installation media, the presenter gets past the login by retrieving a BitLocker recovery key that default cloud settings let users fetch for their own devices, then swaps a system binary for a command prompt and reaches an administrator through a safe-mode trick. He then creates a scheduled task that adds a domain administrator account, and shows how admin rights allow file protections to be overridden and other user sessions to be taken over.

The closing section makes the business case. Customer figures are shown for fewer support tickets and reinstallations after standard users were introduced, and the speaker suggests that non-admin machines stay faster and last longer. The takeaway is to present least privilege in terms of users' productivity rather than as a security rule, because a control that blocks people's work tends to lose the argument.