+AC-12 Session Termination
---+AC-12(01) User-initiated Logouts
---+AC-12(02) Termination Message
---+AC-12(03) Timeout Warning Message
|
AC-12 Session Termination
Control
Automatically terminate a user session after [Assignement: conditions or trigger events].
Discussion
Session termination addresses the termination of user-initiated logical sessions (in contrast to [SC-10](#sc-10) , which addresses the termination of network connections associated with communications sessions (i.e., network disconnect)). A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user) accesses an organizational system. Such user sessions can be terminated without terminating network sessions. Session termination ends all processes associated with a user’s logical session except for those processes that are specifically created by the user (i.e., session owner) to continue after the session is terminated. Conditions or trigger events that require automatic termination of the session include organization-defined periods of user inactivity, targeted responses to certain types of incidents, or time-of-day restrictions on system use.
Assessment Objective
a user session is automatically terminated after [Assignement: conditions or trigger events].
Assessment Method
Examine
Access control policy
procedures addressing session termination
system design documentation
system configuration settings and associated documentation
list of conditions or trigger events requiring session disconnect
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
system developers
1. Pregled
1.1 Reference
1.2 Utvrđeni zahtjevi
1.3 Povezani propisi
2. Utvrđeni zahtjevi
3. Povezani propisi
Povezani zadaci
|