5

Security and usability are often colliding. When it comes to locking screens on workstations after a certain amount of inactivity this is definitely the case and complaints have to be expected from end users.

As far as my experience goes, locking the screen on a workstation after 10-15 minutes is considered best practice. To enforce such a policy it would help to reference an established security standard that says the same. Unfortunately I have only found standards so far that mention screen locking as a must, but do not suggest appropriate values for "time of inactivity before locking".

Is there any established standard I can reference? It would be especially nice if there would be 2 values, one for workstation use inside the company and one for laptop users who work on the road or the home office.

12

The large standards (ISO, NIST) tend toward one-size fits all, the real intent is to promote careful consideration, and deliberate and informed decision making. Specific values such as these are a property of a good policy implementation, the slightly abstract standards tend to only recommend maxima or minima, if even.

Such a "control" is typically assigned a persistent, unique identifier by a particular standard, the common ones are suitable here are AC-11 and SC-10 (from NIST SP800-53(PDF) ) and FTA_SSL (from ISO/IEC 15408, aka Common Criteria for Information Technology Security Evaluation, "FTA" is the class of access control, "SSL" refers to session locking).

Roughly from more-specific to less-specific:

  • OMB M-06-16 (PDF) U.S. Presidential Memorandum Protection of Sensitive Agency Information

     3. Use a "time-out" function for remote access and mobile devices requiring user re- authentication after 30 minutes inactivity; and

  • Australian DSD Information Security Manual 2013 Controls Session and Screen locking, Control 0427

    · configure the lock to activate either:

    • after a maximum of 15 minutes of system user inactivity
    • if manually activated by the system user

    (see also control 0428 which states 10 minutes for "confidential" and "secret" levels). Unchanged in 2014 edition.

  • U.S. CNSS CNSSI-1253 Security Categorization And Control Selection For National Security Systems

    Control AC-11 Session lock

    ...not to exceed 30 minutes

  • NIST SP800-53 Recommended Security Controls for Federal Information Systems and Organizations

    NIST SP800-46 Guide to Enterprise Telework and Remote Access Security

    Control AC-11 Session Lock: Timeout is "organization defined" (See also Canadian ITSG-41) Control SC-10 Network Disconnect

    SP800-46 suggests 15 minutes as appropriate for remote access (page 4-3)

  • PCI-DSS v2

    8.5.15 If a session has been idle for more than 15 minutes, require the user to re-authenticate to re-activate the terminal or session.

    (in v3 the requirement has been renumbered to 8.1.8, but otherwise unchanged) and

    12.3.8 Automatic disconnect of sessions for remote-access technologies after a specific period of inactivity

  • U.S. FBI/DoJ CJISD-ITS-DOC-08140-5.2 Criminal Justice Information Services Security Policy

    5.5.5 Session Lock

    The information system shall prevent further access to the system by initiating a session lock after a maximum of 30 minutes of inactivity, and the session lock remains in effect until [...]

  • ECMA ECMA-271 Extended Commercially Oriented Functionality Class for Security Evaluation

    7.4.1.8 Session lock or terminate The TOE shall support a session lock. The TOE shall provide an idle process monitor for each front-end which inhibits after a customer defined amount of time user interactions except user authentication.

    Rather old (December 1999) the same time frame as ISO/IEC 17799:2000, sadly never updated by ECMA. TOE is Target Of Evaluation, some Common Criteria terminology.

  • ISO 27001:2005(E)/ISO 27002:2005(E)(see this document for a useful overview) Control A.11.3.3 Clear desk and clear screen policy §11.3.3.3

    The clear desk and clear screen policy should take into account the information classifications (see 7.2), legal and contractual requirements (see 15.1), and the corresponding risks and cultural aspects of the organization.

    See also §11.5.5 Session time-out

  • Council On CyberSecurity Critical Security Controls v5.1

    CSC 16-6 Configure screen locks on systems to limit access to unattended workstations.

  • CERT Knowledge and Information Management (KIM) KIM:SG4.SP2 Control Access to Information Assets

    [...] The organization must decide upon the right mix of controls to address the various forms of the information asset and any special considerations of the asset.

There's absolutely nothing wrong with using your own values once you have properly defined your risks and requirements, and documented the decisions. You may even decide on session lock exemptions (e.g. in the case of air traffic control, or locations with enhanced physical security), or mandate proximity devices.

2

Standards, by their nature, have to be more generalised than that, so that they are useful for a wide range of organisations. Even within your own organisation you suspect there are two sensible values - machines that are always in an access controlled space could potentially have looser security than ones that might be left unattended in public spaces.

Perhaps it will help to gently remind your users that it is their fault you have to do this at all:

"You should always lock your computer when you leave it unattended. explain how to. In case you forget, your workstation is automatically locked after x minutes of activity."

1

The Center for Internet Security says 15 minutes, in the Windows 7 benchmark. https://benchmarks.cisecurity.org/ It doesn't mention a distinct for mobile vs office users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.