Set a session timeout policy for all admin accounts

A session timeout policy for admin accounts addresses a genuine, specific risk window — an administrative session left active and unattended, whether due to stepping away from a device or simply forgetting to log out, represents a real opportunity for unauthorized access if that device or session becomes accessible to someone else during this unattended period.

This protection works through automatically ending administrative sessions after a defined period of inactivity, requiring re-authentication before continued access — this closes the specific risk window an indefinitely persistent session would otherwise leave open, limiting the practical exposure even if a device is left unattended or a session is somehow compromised.

The appropriate timeout duration deserves genuine, balanced consideration — an overly aggressive, short timeout creates meaningful friction for legitimate ongoing work, potentially encouraging workarounds that undermine the security benefit, while an overly generous timeout provides only weak protection against the genuine risk this policy is meant to address, making thoughtful calibration specific to your actual usage patterns worthwhile.

This represents a genuinely important complement to the broader authentication security discussed elsewhere throughout this security work — strong passwords and two-factor authentication protect the initial authentication moment, while session timeout policy protects against risk that emerges after successful authentication, during the actual period a session remains active.