- [Narrator] Session management attempts
to ensure the integrity of user connections
by using timeouts and screensavers to disconnect users
who have gone idle.
This is an important part of accountability,
preventing someone who stumbles across
an authenticated session from taking control
of the legitimate user's account.
Timeouts are very simple but effective security controls.
They come in three different forms.
First, timeouts may simply disconnect a user session
after a certain amount of time has passed.
This is somewhat of a brute force approach to timeouts.
It may be easy to implement but it often results
in user dissatisfaction.
For example, I once worked at an organization
that used an automatic timeout on VPN connections
after two hours.
Telecommuters found this completely intolerable
because they were connected to the VPN all day
as they worked and wound up getting bounced
off the network every two hours.
Second, timeouts may monitor a user session for inactivity.
Once a user goes idle, the system starts a timer
set to a predefined value, such as 10 minutes.
If the user doesn't perform some activity during that time,
the system disconnects the user session.
Third, timeouts may function in a soft manner.
Instead of disrupting a user session completely,
they may simply prevent the user
from performing any sensitive actions
until he or she reauthenticates.
This is a pretty friendly approach to timeouts
that is less disruptive than approaches
that simply kick a user out of the system immediately.
Screensavers are a common form of timeout on work stations.
It would be very inconvenient if users
were logged out of their computers
after a period of inactivity,
so screensavers offer a compromise.
Instead of logging the user out of the system
and disrupting their work,
the screensaver simply activates
after the user becomes inactive
and then requires that the user authenticate
to deactivate the screensaver.
Once the user successfully authenticates,
he or she is returned to the session
that was already in progress.
Let's take a look at how you can activate
an authentication-protected screensaver in Windows.
Here we are in the control panel.
I'm going to go ahead and click on
appearance and personalization and then change screensaver.
As you can see, right now this system
has no screensaver set to protect it.
I can go here and change this from none
to whichever screensaver I like.
Let's choose bubbles.
Then down here I'm able to specify the number of minutes
that I would like to pass
before the screensaver becomes active.
I'm going to go ahead and turn this on
for a 10-minute delay
and then click on resume display login screen.
This will ensure that once the user's session times out,
they have to reauthenticate before
they're able to get past the screensaver
and resume their activity.
Screensavers and timeouts are important
session management tools that prevent
unauthorized individuals from taking control
of an inactive user session.