+SC-23(01) Invalidate Session Identifiers at Logout

SC-23(01) Invalidate Session Identifiers at Logout

Control

Invalidate session identifiers upon user logout or other session termination.

Discussion

Invalidating session identifiers at logout curtails the ability of adversaries to capture and continue to employ previously valid session IDs.

Assessment Objective

session identifiers are invalidated upon user logout or other session termination.

Assessment Method

Examine

System and communications protection policy procedures addressing session authenticity system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
is blocked by SC-23(01) Invalidate Session Identifiers at Logout – Assessment Procedure
is blocked by Invalidate Session Identifiers at Logout