The identification and authentication of users is intended to prevent a client from being used in an unauthorised manner. However, IT systems in which users are required to identify and authenticate themselves via user IDs and passwords can also be used in an authorised manner if an attacker succeeds in obtaining or guessing access data. If no screen lock is activated, it is also possible for a client to be used in an unauthorised manner, even during a short absence.