3

I was experimenting over the past few days with letting my laptop hibernate vs. shutting down on a daily basis (I have always been a shutdown guy, but am trying to update myself). While on business travel I used the corporate VPN to connect back to the the company network for e-mail, file access, etc. I logged into our VPN using a soft-token that requires a PIN to get the secondary log in password (a pseudo-random number). Over the next two days I changed my location and WiFi network several times, simply hibernating the laptop and never shut it down. I did expect the VPN connection to persist for brief hibernation times (e.g. an hour or so), but was very surprised when after 8 hours of hibernation overnight, the VPN connection had persisted. I never had to re-enter the number from the soft token. I had expected a message along the lines of "sorry - time's up. Re enter your token key please."

I looked both on Information Security Stack Exchange and on-line generally and did not find any clear guidance. I did notice several organizations that provide VPN, such as universities, clearly state in their VPN FAQ's that the VPN would time out after 8 hours and users would have to re-enter their credentials.

I see a vulnerability: if someone had my login password (which I type in each time to wake up the computer, so they could simply video me entering it) and then gets the computer, they now have VPN access into my company. It seems to me to defeat the purpose of the soft token.

Is it considered a security best practice to "time out" the VPN connection on a predetermined basis, forcing credential re-entry? If so, what would be a good baseline time period for laptops on business travel?

Improve this question
2
  • 1
    Soft tokens are very good at stopping remote attacks from random people on the internet. For example, they protect well against a password database leak. They do not protect well against in-person attacks because people can typically just grab your token while they're at it.
    – Neil Smithline
    Jun 16, 2016 at 15:06
  • True - I am not sure it matters for this question, but the token we use is actually an app on my smart phone. I have to enter a PIN code to get the pseudo-random number to enter into the VPN software when it asks for it.
    – Stone True
    Jun 16, 2016 at 15:30

1 Answer 1

Reset to default
2

This will depend entirely on the use case for the majority of the staff.

If they typically run long term sessions because their applications or work require it, then you can be sure that trying to move to a shorter session length will cause problems.

If they mostly run applications that can work unattended and only need to be checked later, then a very short session time may be appropriate.

This is one of those areas where you need to weigh up usability and security. If you are in a position where someone stealing your laptop and videoing or watching you entering your pin is a realistic risk then perhaps it is appropriate to have a conversation with your IT team. So no, there is no 'best practice' as it will depend entirely on your requirements.

Most organisations I have worked with have an RSA token or a soft token as part of the connection, so they would have to steal the token, know the username and password and PIN. All without me knowing, as I could call in and cancel it if I knew it was stolen.

Improve this answer
2
  • Another consideration is that many firewalls have a grace/timeout period that maintain what traffic goes where, so that after say 15 minutes of no activity, the firewall stops remembering what specific port/IP address pairs are part of a connection. Hence you will often see Unix users invoke the top command with a refresh of 10 minutes to keep the VPN tunnel open.
    – Mark Stewart
    Jun 16, 2016 at 17:08
  • The use case is a lap top on business travel. I do have a token that requires a PIN, BUT the VPN did not ask for that upon resuming from hibernation. I will edit the question to make this clear.
    – Stone True
    Jun 16, 2016 at 18:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .