+SC-23(01) Invalidate Session Identifiers at Logout

SC-23(01) Invalidate Session Identifiers at Logout

Control

Invalidate session identifiers upon user logout or other session termination.

Discussion

Invalidating session identifiers at logout curtails the ability of adversaries to capture and continue to employ previously valid session IDs.

Assessment Objective

session identifiers are invalidated upon user logout or other session termination.

Assessment Method

Examine

System and communications protection policy procedures addressing session authenticity system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by SC-23(01) Invalidate Session Identifiers at Logout – Assessment Procedure
is blocked by Invalidate Session Identifiers at Logout