What is a one sentence summary of your feature request?
ISO 27001 / NIS2 aligned Multi-Level Session Security with adaptive re-authentication, Soft Auto Logoff and Push-Based Session Validation for Password Secure.
Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.
Current Password Secure session timeout functionality only supports a full logout after a configurable inactivity period.
This creates a common challenge for organizations that need to balance strong security requirements with administrator productivity and user acceptance.
We propose a Multi-Level Session Security concept based on risk-based re-authentication, Zero Trust principles and the requirements of ISO 27001, NIS2 and NIST authentication guidance.
Proposed functionality:
Level 1 - Very Soft Auto Logoff
After 5* minutes of inactivity inside Password Secure:
• Session remains active
• Credentials are temporarily hidden or locked
• User receives a push notification through the Password Secure Mobile App or configured MFA App
• Single push approval reactivates the session
• No password re-entry required
Level 2 - Soft Auto Logoff
After 15* minutes of inactivity:
• Session remains active
• User must re-enter the Password Secure password
• No MFA challenge required
• Existing trusted session remains valid
Level 3 - Full Auto Logoff
After 2* hours of inactivity:
• Complete logout
• Username, password and MFA required
• New authenticated session must be established
Additional Enhancement
Introduce a dedicated Soft Auto Logoff timer between the current inactivity timer and a complete logout. This would allow organizations to enforce stronger security controls while maintaining operational efficiency.
Benefits:
• Better alignment with ISO 27001, NIS2 and Zero Trust concepts
• Reduced exposure of unattended privileged sessions
• Increased user acceptance of shorter timeout settings
• Reduced administrative frustration caused by frequent full logins
• Improved security posture without negatively impacting productivity
• More flexible session management for administrator workloads
Many modern enterprise solutions already implement graduated session security and adaptive re-authentication rather than enforcing an immediate full logout after a fixed inactivity period.
- = times ar adjustable via settings for users, roles, ou’s within password secure
How do you currently solve the challenges you have by not having this feature?
Currently we are forced to choose between two extremes:
-
Short session timeouts (for example 10 minutes)
• High security
• Frequent re-authentication
• Significant impact on administrator productivity
• Increased frustration for daily operational users -
Long session timeouts (for example 1 to 2 hours)
• Better user experience
• Reduced security for unattended workstations
• Larger exposure window for privileged sessions
At the moment organizations can only change the timeout value globally per client type and cannot introduce intermediate security controls.
As a result, many organizations choose longer timeout values than desired because full re-authentication after only a few minutes of inactivity is not practical for operational IT work.
A multi-level session security model would allow organizations to improve security while maintaining usability and operational efficiency.