In a web-application the session time-out is not defined neither in the application nor in the application configuration. But the default time out is taken from the IIS. what is the security issue if the session time-out is default IIS server session value? Does issue vary from IIS to web sphere?