When automatic login may be acceptable from the point of view of security?

Question

In my organization some IT people is requesting to install devices with automatic login configured. The reason they defend is that the user will be able to perform only very low risk actions: for example, navigating only to one site and not being able to execute any other process.

Is it acceptable to have automatic login in this scenario?

Would be a more complex scenario acceptable?

Will it depend entirely on how the device is used and how we protect that the user escape the security measures and use the device in a non authorized way?

EDIT: When I say "automatic login" I mean "without any type of authentication", booting right to the desktop. Like a "kiosk mode".

Answer 1

We would need some more information on your use case. Is this a kiosk computer?

In this scenario you no longer have the ability to tie specific actions to specific users. Furthermore, users may accidentally leave information which is exposed to other users unexpectedly/inappropriately. Another user may also do something malicious while they have access and this would easily impact the next user.

A lot will depend on your situations. Perhaps it would be acceptable to have some sort of automatic login with a badge or smartcard without and additional password authentication on this machine - thus, each user still have a separate session.

You might also want to look into some controls to wipe back to a clean state and to force a maximum session. This would help to address the risk of one user doing something malicious which will impact the next user or the first user accidentally leaving confidential information which the next user should not see.

There is software like Deep Freeze that can provide some such features. You may also want to use some type of thin client setup that only goes to a Citrix session on a VM that you can easily roll back to a point in time.

While the actions the user is intended to do are low, the risk is still high in the actions the user could do. You can balance the risk with some processes and controls.

Note just running a system in Kisok mode without rebuilding to a clean state is not sufficient, as the user may modify the browser or find system artifacts, even in a locked down browser using a privacy/incognito mode.