I'm currently evaluating the configuration of Chrome for Business in a corporate environment. There is a setting which prevents users from signing into Chrome with their personal accounts. My gut feeling is that this should be disabled but I am struggling to identify the risk of allowing this. Whilst this question refers to Chrome the discussion really is transferable across browsers.
As far as I am aware the user would be able to perform the following if we were to allow them to sign-in:
- Sync bookmarks across multiple devices
- Sync saved passwords across multiple devices
This is the biggest one for me. If corporate credentials are saved and stored locally on an uncontrolled device the chances of those credentials becoming compromised is increased. However, I'm currently unsure how Chrome stores passwords (although I have read multiple articles suggesting it is not secure!) i.e. are all saved passwords stored locally devices where the user is signed into Chrome irrespective if the site that the saved credentials is associated with has been accessed on a particular device.
- Sync enabled extensions across multiple devices
This is mitigated by the fact we will block the installation of non-approved extensions using a whitelist approach.
I would be interested to know your thoughts on this or what you may have implemented within your orgs.