What is the real danger of not putting a login password in Windows in a small company except that of allowing anyone to go physicaly on your computer?

Question

My question is simple. I work in a company of 10 employees where none of our computers have passwords to login into our Windows systems. The thing is my boss doesn't want passwords because he thinks that we have nothing to hide and also because it's work related computers, not personal computers.

But as an IT in this company, I'm a little bit curious about security here. We always hear that you should put a password on our computers. But what about a small company where there is almost always someone at our desks for surveillance of use of computers by any third-party, except some delivery people or clients that could potentially pass by our computers.

So, is there a substantial danger, besides that of someone physically accessing your computer, in leaving your computers without any password? I mean, if your SMB port is open and vulnerable to Wanna Cry for example, it doesn't matter if you don't have password, right? The worm will still get in once your computer is turned on. If a virus tries to get into your system and you have no password, is it easier for it to elevate its privileges to admin? If the UAC control is independent of your Windows password, you will still have this protection in place to thwart any attempt of privilege escalation, right?

Thank you

Answer 1

In a nutshell, besides physical, local access - there is no more of a risk of not having a password than having one. Besides, the obvious risk of anyone being able to walk up to your computer and log in.

There are a number of risks however that come from fraud and fraud prevention. Since anyone can walk up to any computer and log in, if anything malicious were to happen (and it does) you would have no way to prove who it was.

EDIT: if you're on windows 7 you can use autologin: https://technet.microsoft.com/en-us/library/ee872306.aspx

FRAUD AND FRAUD PREVENTION

Typically, an organization would have controls in place to prevent fraud from occurring in the first place. The idea being that the more difficult it is to prevent fraud, the more unlikely it will be that it will occur. I'll outline a rough scenario at the end if that helps clear it up for you.

A common control method is proper passwords, so that someone couldn't walk up to a computer, use it for some malicious activity, and then walk away. Keep in mind that this person may be from outside the company as well - ie. could be a repairman, could be an auditor, health inspector, etc. depending on your line of work, not just someone from inside the company.

SCENARIO

An organization has no passwords on their computers - An employee, Jane, was one of three employees let go due to work force reduction from a budget cut. Her job was to manage the company account for making purchases from new suppliers.

A few weeks after she was let go, her replacement noticed some irregularities in the accounts that she was in charge of. An internal investigation was launched, which found that almost $5000 had gone missing over the past 18 months. An external auditor was called in to assess the situation and a fraud investigator acquired them to find out what happened.

They discovered that the Janes computer was used to move the money, however it was always during her out of office hours. They also discovered that no-one in the company uses passwords on any of their computers, meaning that it could be anyone who would've had physical access during those 18 months. They also found from conducting an interview that Jane left with no issues, and left them with little reason to think it was her.

So who could it be?

SCENARIO 2

Same as above except employees use passwords -

They discover that Janes computer was used to move the money, and it was always during out of office hours. However it was not her login details that had been used, but rather the hiring manager for the floor.

An investigation was launched and found that he was having some issues at home with his spouse, which could be a potential motivator.

etc. etc.

The point being that in each of these situations, even with passwords being used its difficult to say who it was that committed the crime. However, in the case of scenario 2 - the hiring manager would have to explain why he logged in with his details outside of normal hours, or how his credentials had been potentially 'hacked'.

Hope that clears things up a bit. I can expand further if not.

EDIT: Just to add since @Sayan's point - it is known in security as non-repudiation - or being able to prove that something happened by whom

Answer 2

One of the main security concern would be 'Non-repudiation'.

Non-repudiation is the evidence/assurance that someone cannot deny on their action. Hence in your case if anything goes wrong you may ended up with a situation where you cannot take any actions.

Because you may not be able to produce digital evidence for the case.

You may refer below article for more details about Non-repudiation: https://searchsecurity.techtarget.com/definition/nonrepudiation

Answer 3

From the attack vector of the network, it does not make it any less secure.

But I have two examples of why it is just a bad idea. At one company I was at the cleaning staff used the receptionists computer to look at porn. When she got in the next day, she immediately called the police. While nothing actually required police intervention it was a day of wasted time.

The next is a common example of a disgruntled employee causing damage the next day. And as others have said, no passwords make attribution difficult. Video of insider hack - http://www.youtube.com/watch?v=fqcwNabyfoo