1

In my organization some IT people is requesting to install devices with automatic login configured. The reason they defend is that the user will be able to perform only very low risk actions: for example, navigating only to one site and not being able to execute any other process.

Is it acceptable to have automatic login in this scenario?

Would be a more complex scenario acceptable?

Will it depend entirely on how the device is used and how we protect that the user escape the security measures and use the device in a non authorized way?

EDIT: When I say "automatic login" I mean "without any type of authentication", booting right to the desktop. Like a "kiosk mode".

Improve this question
8
  • 2
    what do you mean by "automatic login"? – schroeder♦ Dec 24 '15 at 17:02
  • 1
    My guess is that he means no authentication at all...(?) – Jeroen Dec 24 '15 at 17:20
  • What are the devices? Are they going to be installed inside your firewall? – Neil Smithline Dec 24 '15 at 17:33
  • And when you discover that the system is being used for other purposes, how will you investigate this? – symcbean Dec 25 '15 at 0:29
  • When you say "automatic login", are you referring to Single Sign On(SSO)? – JOW Dec 25 '15 at 4:26
5

We would need some more information on your use case. Is this a kiosk computer?

In this scenario you no longer have the ability to tie specific actions to specific users. Furthermore, users may accidentally leave information which is exposed to other users unexpectedly/inappropriately. Another user may also do something malicious while they have access and this would easily impact the next user.

A lot will depend on your situations. Perhaps it would be acceptable to have some sort of automatic login with a badge or smartcard without and additional password authentication on this machine - thus, each user still have a separate session.

You might also want to look into some controls to wipe back to a clean state and to force a maximum session. This would help to address the risk of one user doing something malicious which will impact the next user or the first user accidentally leaving confidential information which the next user should not see.

There is software like Deep Freeze that can provide some such features. You may also want to use some type of thin client setup that only goes to a Citrix session on a VM that you can easily roll back to a point in time.

While the actions the user is intended to do are low, the risk is still high in the actions the user could do. You can balance the risk with some processes and controls.

Note just running a system in Kisok mode without rebuilding to a clean state is not sufficient, as the user may modify the browser or find system artifacts, even in a locked down browser using a privacy/incognito mode.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.