I am working on a security project which gives an admin control over certain devices in a company.

When using the web-based product, say the user switches context and opens another tab or skips to another tab, at what time should we log the user out and force re-credentialling to continue working? Given that the environment in which the user is going to be is mostly within the company, I was assuming a time of 5 minutes after which the user gets logged out.

The concern we have is that an unauthorised bystander might use the device and gain access to the company product.

  • There is no definitive answer to this question. It all depends on your threat model and risk analysis.
    – M'vy
    Sep 10 '18 at 11:27
  • @M'vy can you share a link on how to do a threat model and risk analysis please
    – AmpleUX
    Sep 10 '18 at 11:45
  • Why are you focused on tab switching? If the user puts the device down, then a bystander can use the product directly.
    – schroeder
    Sep 10 '18 at 11:57
  • "An admin control over certain devices in a company" — looks like a perfect case for a certificate-based auth, however, with certificates, there's no such thing as "logout".
    – ximaera
    Sep 10 '18 at 14:17
  • This should be defined in your company's security policy based on a risk analysis and/or threat model as pointed out by @M'vy. Have a look at microsoft.com/en-us/download/details.aspx?id=49168
    – Jeroen
    Sep 18 '18 at 11:23

This is a trade-off between usability and security and therefore there is no "right" answer. However, there are a few guidelines.

PCI DSS says 15 minutes at most:

For a sample of system components, inspect system configuration settings to verify that system/session idle time out features have been set to 15 minutes or less.

ASP.NET has a default timeout of 20 minutes.

For PHP the default timeout is 24 minutes, but this is almost certainly by accident.

Some web applications (Facebook, Gmail) don't have an idle session timeout at all. If you want an idle timeout, around 15 or 20 minutes seems reasonable.

Not the answer you're looking for? Browse other questions tagged or ask your own question.