6

My question is simple. I work in a company of 10 employees where none of our computers have passwords to login into our Windows systems. The thing is my boss doesn't want passwords because he thinks that we have nothing to hide and also because it's work related computers, not personal computers.

But as an IT in this company, I'm a little bit curious about security here. We always hear that you should put a password on our computers. But what about a small company where there is almost always someone at our desks for surveillance of use of computers by any third-party, except some delivery people or clients that could potentially pass by our computers.

So, is there a substantial danger, besides that of someone physically accessing your computer, in leaving your computers without any password? I mean, if your SMB port is open and vulnerable to Wanna Cry for example, it doesn't matter if you don't have password, right? The worm will still get in once your computer is turned on. If a virus tries to get into your system and you have no password, is it easier for it to elevate its privileges to admin? If the UAC control is independent of your Windows password, you will still have this protection in place to thwart any attempt of privilege escalation, right?

Thank you

Improve this question
  • No, I am an in-house SEO and I also happen to take care of IT related stuff in my company. My question wasn't "Is it bad to not put a password on your computer?", I know the answer to that question. My question is "Apart from physical access, what can attacker do to my computer if I don't have a password?". I am asking this because I want to convince my boss that we should all put passwords on our system, but for that I need good arguments because he won't accept that of someone passing by our computers as dangerous enough. I know the answer will be "We are there to keep watch of this.". – wpadmin Jul 3 '18 at 10:53
  • @belramsa Your boss wouldn't give access to the company accounts for people who don't need access, would he? So why should he give access to corporate devices for people who don't need access to them? – J.J Jul 3 '18 at 11:06
  • 2
    One word: liability. If something very wrong has been done, you need to identify who did it. If all computers aren't password protected with user accounts and password, you can't say who did it, and therefore the responsibility will fall on the next person up the chain who had a say on it. – M'vy Jul 3 '18 at 11:53
  • @M'vy Are you talking about an employee inside the company that could have unintentionally made the network vulnerable by installing for example a malicious software? Because even with a password, everyone who knows that password could easily go on that specific computer, I mean in the scenario that all employees would use the same password in the company. – wpadmin Jul 3 '18 at 11:56
  • 1
    One user, one account, one password, no sharing password. If someone downloads unlawful material (I'm sure you can guess what I mean), you need to be able to basically assign the blame so as not to end up in prison yourself (or the IT head). – M'vy Jul 3 '18 at 12:00
3

In a nutshell, besides physical, local access - there is no more of a risk of not having a password than having one. Besides, the obvious risk of anyone being able to walk up to your computer and log in.

There are a number of risks however that come from fraud and fraud prevention. Since anyone can walk up to any computer and log in, if anything malicious were to happen (and it does) you would have no way to prove who it was.

EDIT: if you're on windows 7 you can use autologin: https://technet.microsoft.com/en-us/library/ee872306.aspx

FRAUD AND FRAUD PREVENTION

Typically, an organization would have controls in place to prevent fraud from occurring in the first place. The idea being that the more difficult it is to prevent fraud, the more unlikely it will be that it will occur. I'll outline a rough scenario at the end if that helps clear it up for you.

A common control method is proper passwords, so that someone couldn't walk up to a computer, use it for some malicious activity, and then walk away. Keep in mind that this person may be from outside the company as well - ie. could be a repairman, could be an auditor, health inspector, etc. depending on your line of work, not just someone from inside the company.

SCENARIO

An organization has no passwords on their computers - An employee, Jane, was one of three employees let go due to work force reduction from a budget cut. Her job was to manage the company account for making purchases from new suppliers.

A few weeks after she was let go, her replacement noticed some irregularities in the accounts that she was in charge of. An internal investigation was launched, which found that almost $5000 had gone missing over the past 18 months. An external auditor was called in to assess the situation and a fraud investigator acquired them to find out what happened.

They discovered that the Janes computer was used to move the money, however it was always during her out of office hours. They also discovered that no-one in the company uses passwords on any of their computers, meaning that it could be anyone who would've had physical access during those 18 months. They also found from conducting an interview that Jane left with no issues, and left them with little reason to think it was her.

So who could it be?

SCENARIO 2

Same as above except employees use passwords -

They discover that Janes computer was used to move the money, and it was always during out of office hours. However it was not her login details that had been used, but rather the hiring manager for the floor.

An investigation was launched and found that he was having some issues at home with his spouse, which could be a potential motivator.

etc. etc.

The point being that in each of these situations, even with passwords being used its difficult to say who it was that committed the crime. However, in the case of scenario 2 - the hiring manager would have to explain why he logged in with his details outside of normal hours, or how his credentials had been potentially 'hacked'.

Hope that clears things up a bit. I can expand further if not.

EDIT: Just to add since @Sayan's point - it is known in security as non-repudiation - or being able to prove that something happened by whom

Improve this answer
  • Thank you for your answer. I'm not sure I understand though the fraud part. If I had a password on my computer and somehow something malicious happened, how having a password would help in identifying the culprit? – wpadmin Jul 3 '18 at 11:53
  • Because without a password anyone could walk up to that computer and do whatever to it. With a password you have a much more select group (ideally just one person) who knows the password, and thus is likely to have done whatever was done with it – joedamarsio Jul 3 '18 at 12:03
  • @belramsa Just to clarify: Basically, there are a few common techniques to prevent fraud within a company, even a small one. One of them is having appropriate controls in place to make fraud more difficult to commit. I'll update the answer since this might exceed the length of the comment, – Connor J Jul 3 '18 at 13:24
  • @wpadmin the assumption or intention is that each of the 10 users has their own username and password that they should not be sharing so that you can tell who was logged in and did things. It's the same reason that most companies have a do not share passwords policy. – Evan Steinbrenner Jul 4 '18 at 1:57
  • Hello, I'm back with a question related to this one which I had not thought about at the time. I understand the non-repudiation concept. But as far as network security is concerned, does not having a password on computers facilitate network pivoting? Imagine one computer was compromised on the network, does having a password on other computers will make it more difficult for an attacker to pivot on the network? What if guest accounts are enabled on all computers, does having a password on those computers but not for the Guest accounts prevent an attacker to login as Guest on those computers? – wpadmin Apr 2 '20 at 11:56
2

One of the main security concern would be 'Non-repudiation'.

Non-repudiation is the evidence/assurance that someone cannot deny on their action. Hence in your case if anything goes wrong you may ended up with a situation where you cannot take any actions.

Because you may not be able to produce digital evidence for the case.

You may refer below article for more details about Non-repudiation: https://searchsecurity.techtarget.com/definition/nonrepudiation

Improve this answer
2

Together with the other answers: employee confidentiality.

Whilst these are work computers, there may be the need to store sensitive personal information on them. The boss needs to be able to access all files on the computers, but that does not mean that all files should be shared between all employees. Some possible examples of information that should not be shared without restriction:

  • Confidential medical information, which may be needed at work to complete a risk assessment or insurance application
  • Payslips
  • HR records regarding performance, redundancies etc.

Even without any malicious intent, you could have a scenario like this on your hands: Susan, the head of sales, is going to a conference in another city. For the travel insurance application, she must declare recent medical treatment. She uses her work computer to scan in a letter from her doctor explaining that she was recently diagnosed with cancer, but that she is fine to travel. She has told her boss about her diagnosis, but wants to keep it private from her colleagues for the time being. Whilst she is away at the conference, admin Adam needs access to some client info on Susan's computer. Whilst he is searching for the documents, he comes across the letter from Susan's doctor. He tells the other people in the office, who decide to get Susan a get-well-soon card. Susan returns from the conference, and the other employees all tell her how sorry they are to hear about her cancer. Susan is furious that her wish to keep her health condition private was ignored, and threatens to sue the company.

Most jurisdictions have data protection laws that require employers to protect sensitive employee information for exactly this kind of reason.

Improve this answer
0

From the attack vector of the network, it does not make it any less secure.

But I have two examples of why it is just a bad idea. At one company I was at the cleaning staff used the receptionists computer to look at porn. When she got in the next day, she immediately called the police. While nothing actually required police intervention it was a day of wasted time.

The next is a common example of a disgruntled employee causing damage the next day. And as others have said, no passwords make attribution difficult. Video of insider hack - http://www.youtube.com/watch?v=fqcwNabyfoo

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.