The IDPS must invalidate session identifiers upon user logout or other session termination.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000231-IDPS-000188	SRG-NET-000231-IDPS-000188	SRG-NET-000231-IDPS-000188_rule		Medium

Description
Peering neighbors must have a level of trust with each other since information being shared is used to provide network services, connectivity, and optimized routing. Corrupted or erroneous information shared between the IDPS can disrupt network operations by creating non-optimized forwarding of traffic and network outages. Identifying source and destination addresses for information flows within the network allows forensic reconstruction of events when required, and increases policy compliance by attributing policy violations to specific individuals. Means to enforce this enhancement include ensuring the IDPS authenticates the source involved in sending the information. Unique session identifier must also be used to reduce the risk of session hi-jacking. These session identifiers must be released and invalidated upon user logout or session termination to prevent exploitation by attackers.

Description

Peering neighbors must have a level of trust with each other since information being shared is used to provide network services, connectivity, and optimized routing. Corrupted or erroneous information shared between the IDPS can disrupt network operations by creating non-optimized forwarding of traffic and network outages. Identifying source and destination addresses for information flows within the network allows forensic reconstruction of events when required, and increases policy compliance by attributing policy violations to specific individuals. Means to enforce this enhancement include ensuring the IDPS authenticates the source involved in sending the information. Unique session identifier must also be used to reduce the risk of session hi-jacking. These session identifiers must be released and invalidated upon user logout or session termination to prevent exploitation by attackers.

STIG	Date
IDPS Security Requirements Guide (SRG)	2012-03-08

Details

Check Text ( C-43341_chk )
Verify the configuration for communications to peering neighbors is configured to invalidate session identifiers upon administrator or device logout or other session termination. If the IDPS is not configured to release and invalidate session identifiers upon administrator or device logout or session termination, this is a finding.

Fix Text (F-43341_fix)
Configure the IDPS components to invalidate session identifiers upon administrator or device logout or other session termination