Re: Screensaver Timeouts

[Tim Howard <Timothy_G_Howard () RAYTHEON COM>]

The ultimate answer depends on the sensitivity of the information.  As a
recommendation:

- For users of highly sensitive systems, set the lockout to 1 minute, and
train the users to get accustomed to the perceived inconvenience.  Once
they understand the sensitivity of the information and the need to keep it
protected, they will come around.

- For other users, a 5-7 minute window works well.

- Train all users to use the screen-lock capability every time they leave
their desk.  This gets away from the complacency of users just leaving
their desk and counting on the screen saver to do their job for them.

Tim


Raytheon
Tim Howard
Information Security Manager
Raytheon Information Solutions
301.943.4732 cell;      timothy_g_howard () raytheon com



             "Clonts, Neal D.
             (HSC)"
             <Neal-Clonts@OUHS                                          To
             C.EDU>                    SECURITY () LISTSERV EDUCAUSE EDU
                                                                        cc
             09/13/2005 02:01
             PM                                                    Subject
                                       [SECURITY] Screensaver Timeouts

             Please respond to
               The EDUCAUSE
                 Security
             Discussion Group
                 Listserv
             <SECURITY@LISTSER
              V.EDUCAUSE.EDU>






Fellow Security Professionals,

Our campus is looking at implementing a policy for screensaver timeouts and
we are wondering if anyone else currently has this type of policy in place.
If you do have a policy on screensaver timeouts, how many minutes do you
require before the screensaver is activated?


Neal Clonts, CISSP, CISA, MCP
Information Security Services
University of Oklahoma Health Sciences Center
Office Phone: 405-271-2476, Option 2
Cell Phone: 405-255-2999
Website: http://security.ouhsc.edu