System settings or software installed on a workstation in addition to baseline security measures to provide compensating controls in one or more of the following three modes to offset the risk assumed by granting increased privileges:
- Monitoring Mode: Logs user activity such as installing software
- Practical Security Settings: Requires user to verify software installs before proceeding. This activity must be logged in a location the user would not be able to alter
- Highest Practical Security Settings: Requires that any installed software be added to an “allowlist” of permitted software by an Workstation Manager before allowing it to be installed