RE: To what does everyone set QINACTIVE to autolog off inactiveusers?

Chuck,

Your absolutely right.  Leaving a system for any amount of time creates an
exposure. That's why I would suggest a policy that includes the requirement
for employees to lock their screen everytime they leave their workstation.
However, depending on the circumstances, I might also automatically end the
session after some period of time too.

When analyzing risks you must take into account the probability of the
adverse consequences related to that risk.  So, while an X minute value for
QINACTIVE doesn't eliminate the exposure, it can significantly reduce the
probability of adverse consequences by reducing the window of opportunity
(i.e. the time that the exposure can be exploited) for that exposure.

In most cases, if not all, it is not possible to eliminate risk.
Everything you do with respect to security is aimed at reducing risk -- not
eliminating it.  But, unfortunately, most of us -- including many security
industry experts/ISVs -- talk in terms of "secure" and "un-secure."

Patrick Botz
Senior Technical Staff Member
Rochester CTC, eServer Security Architecture & Consulting
iSeries Security Architect
(507) 253-0917, T/L 553-0917
CTC Fax # 507-253-2070
email: botz@xxxxxxxxxx

For more information on CTC, visit our website at
http://www.ibm.com/eserver/services
http://www.ibm.com/servers/eserver/services


midrange-l-bounces@xxxxxxxxxxxx wrote on 08/16/2005 09:28:25 AM:

> Good points Patrick and a well reasoned note. And the topic of users
leaving
> a session without logging off is indeed a good one. But leaving for even
a
> couple of seconds would cause the same "hole" as 10 minutes, 20 minutes,
> etc. as far as proving someone didn't do something. Short of logging off
> EVERY time you step away (or securing the session some other way) will
allow
> the lawyers to have a field day :-)
>
> JMHO,
>
> Chuck