what are the best practices for timing out an user session for inactivity?

Question

Are there differences between external users and internal users? Transactional systems vs BI?

Answer 1

Inactivity time outs depend on what types of sessions your talking about. Typically, businesses will terminate a session after 30 minutes of inactivity, but for sessions that are deemed more critical, 10 to 15 minutes is more likely. These time outs will apply to internal users as external users should not have access to critical systems thus time out values can be as high as 8 hours in some cases. Another thing to consider is whether or not the external users are employees or customers and how are they connecting to the network. VPN access provides higher levels of security for employees which may allow you to increase the time out value. Also, you have to keep in mind who is connected to any financial systems as you don't want to kill a session for a user who is in the middle of running a large batch of transactions. Finally, this is really not the venue for this type of research. If you're planning on doing this right you really need to take a seminar or hire a consultant to do this right. Sounds to me like you're trying to cut corners and that can be dangerous.