IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Personnel Remarks
____________________________________________________________________ .........................................
S 3.18 Log-out obligation for users
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Head of IT Section, IT Security Management
Where an IT system is used by several users and these persons have different
access rights to the data or programs stored in the IT system, an access control
system will only provide the necessary protection if every user logs off after
finishing his/her task on the IT system. If it is possible for a third party to
work on an IT system under the identity of another person, no form of access
control is possible. Therefore all users must be obliged to log off after
finishing their tasks. For technical reasons (e.g. in order that all opened files
are closed), procedures should also be defined for logging off from IT systems
when no access control system is in operation.
Where absence from the PC is likely to be of only short duration, instead of
logging off it is acceptable to manually activate the screen lock (see also S 4.2
Screen lock). When the user is away from his/her desk for an extended period,
the screen lock should automatically be activated.
Some IT systems allow a period to be specified, such that users are
automatically logged off from the system when they have been inactive for a
certain length of time. On the other hand, such a system can also lead to loss
of data, so it should be thought about carefully. An automatic logoff system
could be used, for example, in PC pools which are heavily accessed by the
public since here a user who is logged on could block the workstation with the
aid of the screen lock without good reason.
Depending on the workstation environment, consideration should be given to
what precautions should be taken for short-term absences of users. Thus the
screen lock should be automatically activated more quickly, e.g. after only
five minutes, in multi-user systems than in systsems used by only one user.
Additional controls:
- Are new staff and deputies also placed under the obligation to log off once
they have finished with the computer?
- Are staff reminded at regular intervals of the obligation to log off?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Screen lock
Automatic logoff