Unattended PCs a menace, says Gartner
Timeouts should be the minimum for workstation security.
By John Dunn | Techworld | Published: 17:01, 29 September 2005
Many organisations are turning a blind eye to the risks posed by PCs left unattended but logged in to networks, says a new analysis from Gartner.
The main risk is that confidential information could be accessed and changed as a means of carrying out fraud, but the tendency of employees to send bogus or prank e-mails is also noted. The latter can have potentially serious legal consequences.
A less obvious but equally damaging issue is that lax PC security offered employees gaining illegal access to data a cover of plausible deniability for their actions. Gartner terms this the “someone else used my PC” defence.
If companies could not prove that the actions had been those of the person using the PC, disciplining them would be difficult.
“There is little point in implementing some sort of sophisticated identity and access management system unless you can ensure that when people are logged in to systems, they stay at their PCs,” said co-author of the analysis, Jay Heiser.
According to Gartner, there is no simple solution to the problem. Some companies should consider using timeouts, forcing users to log back into servers after pre-determined periods. These tend to be unpopular with employees, however.
Another solution for organisations that don’t want to impose repeated log-in procedures on their staff are authentication systems such as proximity tokens.
Such systems are able to automatically disconnect and reconnect users depending on how near they are to the workstation. Logging in requires having a physical token, reducing the risk of unauthorised access.
The snag with these, of course, is that they add cost and management overhead, and are likely to be rejected for this reason. The tokens themselves are also at risk of theft, though many systems can be configured to require passwords as a backup.
If timeouts are used, they should always be shorter for devices connecting through risky technologies such as VPNs. Gartner gives 15 minutes as a useful guide for PCs, 10 minutes for a laptop, and 5 minutes for a handheld computer, but these figures depend on location.
