+SC-23 Session Authenticity
---+SC-23(01) Invalidate Session Identifiers at Logout
---+SC-23(03) Unique System-generated Session Identifiers
---+SC-23(05) Allowed Certificate Authorities

SC-23 Session Authenticity

Control

Protect the authenticity of communications sessions.

Discussion

Protecting session authenticity addresses communications protection at the session level, not at the packet level. Such protection establishes grounds for confidence at both ends of communications sessions in the ongoing identities of other parties and the validity of transmitted information. Authenticity protection includes protecting against "man-in-the-middle" attacks, session hijacking, and the insertion of false information into sessions.

Assessment Objective

the authenticity of communication sessions is protected.

Assessment Method

Examine

System and communications protection policy procedures addressing session authenticity system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities

1. Oversigt

SC-23(01) Invalidate Session Identifiers at Logout

Control

Invalidate session identifiers upon user logout or other session termination.

Discussion

Invalidating session identifiers at logout curtails the ability of adversaries to capture and continue to employ previously valid session IDs.

Assessment Objective

session identifiers are invalidated upon user logout or other session termination.

Assessment Method

Examine

System and communications protection policy procedures addressing session authenticity system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities
SC-23(03) Unique System-generated Session Identifiers

Control

Generate a unique session identifier for each session with [Assignement: randomness requirements] and recognize only session identifiers that are system-generated.

Discussion

Generating unique session identifiers curtails the ability of adversaries to reuse previously valid session IDs. Employing the concept of randomness in the generation of unique session identifiers protects against brute-force attacks to determine future session identifiers.

Assessment Objective

  1. a unique session identifier is generated for each session with [Assignement: randomness requirements];
  2. only system-generated session identifiers are recognized.

Assessment Method

Examine

System and communications protection policy procedures addressing session authenticity system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities
SC-23(05) Allowed Certificate Authorities

Control

Only allow the use of [Assignement: certificated authorities] for verification of the establishment of protected sessions.

Discussion

Reliance on certificate authorities for the establishment of secure sessions includes the use of Transport Layer Security (TLS) certificates. These certificates, after verification by their respective certificate authorities, facilitate the establishment of protected sessions between web clients and web servers.

Assessment Objective

only the use of [Assignement: certificated authorities] for verification of the establishment of protected sessions is allowed.

Assessment Method

Examine

System and communications protection policy procedures addressing session authenticity system design documentation system configuration settings and associated documentation list of certificate authorities allowed for verification of the establishment of protected sessions system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by SC-23 Session Authenticity – Assessment Procedure
is blocked by Session Integrity