What type of seesions are you referring to? My guess is SAS/Studio as there is a 1 hour default in the settings for this. Best practice would depend on a number of factors including how users work with SAS and also site security requirements. For example you can now run batch jobs from SAS/Studio - if SAS times out before the batch job completes then that isn't very convenient.
I would suggest setting timeouts to at least cover a working day, say 8 hours. IT Security might have different ideas.
Note also that SAS might also be affected by external network and communications related timeouts as well.