The low level socket server does not include any timers, but the higher level HTTP and FTP server component do include various timeouts. TWSocket itself includes a TWSocketCounter class which descendents can check periodically with a timer to close idle connections, depending on activity.
For HTTP, the procedure HeartBeatOnTimer checks whether a request is being processed and disconnects according for KeepAliveTimeSec or KeepAliveTimeXferSec. You could add something similar including checking whether SSL has been negotiated.
If you are concerned about hacking attempts, I find it's actually better to leave connections open for a long time, doing nothing, which stops the remote robot doing anything else with that connection, close it immediately and it moves on to the next attack attempt.
The OverbyteIcsSslMultiWebServ sample includes various hacking tests, and sends a response after a one minute delay. One test I added to my public web server is any access by IP address instead of host name, immediately onto the hackers list.
This is also in a new sample I added yesterday, OverbyteIcsDDWebService, which is similar to OverbyteIcsSslMultiWebServ but runs as a real Windows service or a GUI for debugging). and includes a new database REST server sample.
Angus