1

I'm currently evaluating the configuration of Chrome for Business in a corporate environment. There is a setting which prevents users from signing into Chrome with their personal accounts. My gut feeling is that this should be disabled but I am struggling to identify the risk of allowing this. Whilst this question refers to Chrome the discussion really is transferable across browsers.

As far as I am aware the user would be able to perform the following if we were to allow them to sign-in:

  • Sync bookmarks across multiple devices
  • Sync saved passwords across multiple devices

This is the biggest one for me. If corporate credentials are saved and stored locally on an uncontrolled device the chances of those credentials becoming compromised is increased. However, I'm currently unsure how Chrome stores passwords (although I have read multiple articles suggesting it is not secure!) i.e. are all saved passwords stored locally devices where the user is signed into Chrome irrespective if the site that the saved credentials is associated with has been accessed on a particular device.

  • Sync enabled extensions across multiple devices

This is mitigated by the fact we will block the installation of non-approved extensions using a whitelist approach.

I would be interested to know your thoughts on this or what you may have implemented within your orgs.

  • there isn't a question here but what looks like a call for collective experiences, which is not a good fit on Stack Exchange - do you have a specific question? – schroeder Nov 2 '17 at 15:58
  • 1
    I would flip the scenario: is there a valid business reason to allow signing in with personal accounts? If not, don't expose the risk. – schroeder Nov 2 '17 at 15:59
  • That is exactly it @schroeder. Permissions are things that should only be granted when needed: removing access when not-needed is the wrong way to approach any security problem. That's a starting principle for defense-in-depth, which is otherwise known as "the only kind of defense that works". – Conor Mancone Nov 2 '17 at 17:15
  • @schroeder, I completely agree with you. Naturally in a corporate environment the business aren't always willing to accept such changes without identifying the risks we are attempting to mitigate. Thanks to both for you insight. – JLPH Nov 3 '17 at 10:47
0

My org agreed chrome extensions and syncing were high risk. The main concern was extensions due to the fact they can control all web traffic in the browser thus need to be patched and whitelisted to run. We have syncing accounts disabled.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.