Gartner: Unattended PCs a menace

TechWorld.com - Many organizations turn a blind eye to the risks posed by PCs that are logged into corporate networks but left unattended, according to a new analysis from research firm Gartner Inc.
The main risk is that confidential information could be accessed and changed in an effort to carry out fraud, Gartner said, although the tendency of employees to send bogus or prank e-mails is also a concern. The latter can have potentially serious legal consequences.
Another potentially damaging issue is that lax PC security could allow employees who gain illegal access to data a way to plausibly deny any wrongdoing -- something Gartner termed the "someone else used my PC" defense. If companies can't prove that malicious activity was done by the person using the PC, disciplining them would be difficult.
"There is little point in implementing some sort of sophisticated identity and access management system unless you can ensure that when people are logged into systems, they stay at their PCs," said Jay Heiser, co-author of the report.
According to Gartner, there is no easy solution to the problem. Some companies should consider using timeouts, which force users to log back into servers after predetermined periods. But that idea tends to be unpopular with employees.
Another solution for organizations that don't want to impose repeated log-ins on their staffs are authentication systems such as proximity tokens. Such systems are able to automatically disconnect and reconnect users depending on how close they are to their workstations. Logging in requires having a physical token, which can reduce the risk of unauthorized access.
Those options, however, can add cost and management overhead, and the tokens themselves could be stolen -- though many systems can be configured to require passwords as a backup.
If timeouts are used, they should always be shorter for devices connecting through risky technologies such as VPNs. Gartner suggested 15-minute time-outs as a useful guide for PCs, 10 minutes for a laptop and five minutes for a handheld computer. But those time-out proposals depend on location.