We just introduced multi-factor authentication (MFA) to access a remote business network. This has a re-authentication option: to prompt the user to re-enter the password and MFA code periodically. Like most topics in information security, the re-authentication interval has a tradeoff between security and convenience: a short amount (like 1 hour) has greater security but is inconvenient, while a longer amount (like 8 or 12 hours) is more convenient but has lower security.
Our workers need to access this network throughout the business day. What is a reasonable duration? 4, 6, 8, 12 hours? Something else? Thanks.