I was experimenting over the past few days with letting my laptop hibernate vs. shutting down on a daily basis (I have always been a shutdown guy, but am trying to update myself). While on business travel I used the corporate VPN to connect back to the the company network for e-mail, file access, etc. I logged into our VPN using a soft-token that requires a PIN to get the secondary log in password (a pseudo-random number). Over the next two days I changed my location and WiFi network several times, simply hibernating the laptop and never shut it down. I did expect the VPN connection to persist for brief hibernation times (e.g. an hour or so), but was very surprised when after 8 hours of hibernation overnight, the VPN connection had persisted. I never had to re-enter the number from the soft token. I had expected a message along the lines of "sorry - time's up. Re enter your token key please."
I looked both on Information Security Stack Exchange and on-line generally and did not find any clear guidance. I did notice several organizations that provide VPN, such as universities, clearly state in their VPN FAQ's that the VPN would time out after 8 hours and users would have to re-enter their credentials.
I see a vulnerability: if someone had my login password (which I type in each time to wake up the computer, so they could simply video me entering it) and then gets the computer, they now have VPN access into my company. It seems to me to defeat the purpose of the soft token.
Is it considered a security best practice to "time out" the VPN connection on a predetermined basis, forcing credential re-entry? If so, what would be a good baseline time period for laptops on business travel?