Depends on:
- type of data being accessed (your RBACs should handle this)
- type of people accessing the network (RBACs again)
- organizational needs (see the last two parentheticals about RBACs)
I've worked with customers who have no idle expiration. And I've worked with ones that time-out at 10 minutes (or less!) if you're not "active".
My current main customer has a 24-hour timeout – regardless of activity level.
January 27, 2020 at 09:58AM
via reddit https://www.reddit.com/r/security/comments/euoqx9/question_i_am_in_the_process_of_helping_an/ffqkkuc?utm_source=ifttt