Title

Automatic logout due to inactivity must be disabled. (Cat III impact)

Discussion

Although some might want to enable automatic logout based on inactivity, there are reasons why this feature should be disabled. First, it can disrupt workflow. Second, it can close applications or processes without approval (but a password-protected screen saver will not close applications). Third, because automatic logout can be interrupted, it provides a false sense of security.

Check Content

1. Open System Preferences->Security. 2. Select General tab. 3. Ensure "Log out after x minutes of inactivity" is not checked. If it is checked, this is a finding.

Fix Text

1. Open System Preferences->Security. 2. Select General tab. 3. Deselect "Log out after x minutes of inactivity".

Additional Identifiers

Rule ID: SV-37262r1_rule

Vulnerability ID: V-25331

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.