OpenControls Logo

STIG Viewer

STIGViewer Support

The ICS must terminate remote access network connections after 10 minutes or less.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-258591IVCS-VN-000260SV-258591r1136932_ruleCCI-000057medium
Description
Best practice is to terminate inactive user sessions after a period; however, when setting timeouts to any VPN connection, the organization must consider the risk to the mission and purpose of the VPN. VPN connections that provide user access to the network are the prime candidates for VPN session termination and the primary focus of this requirement. To determine if and when the VPN connections warrant termination, the organization must perform a risk assessment to identify the use case for the VPN and determine if periodic VPN session termination puts the mission at significant risk. The organization must document the results and the determination of the risk assessment in the VPN section of the SSP. The organization must also configure VPN session terminations in accordance with the risk assessment. Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed network element. Terminating network connections associated with communications sessions includes, for example, deallocating associated TCP/IP address/port pairs at the operating system level and deallocating networking assignments at the application level if multiple application sessions are using a single, operating system-level network connection.
STIGDate
Ivanti Connect Secure VPN Security Technical Implementation Guide2025-09-09

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-24Session Lock
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (18) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-11Device Lock
1.00
AC-11(1)Pattern-hiding Displays
1.00
AC-12Session Termination
1.00
AC-12(2)Termination Message
1.00
AU-10Non-repudiation
1.00
CM-7Least Functionality
1.00
IA-11Re-authentication
1.00
IA-2Identification and Authentication (Organizational Users)
1.00
IA-2(1)Multi-factor Authentication to Privileged Accounts
1.00
IA-2(12)Acceptance of PIV Credentials
1.00

+8 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.10
1.00
CCI1 mapping
CCI-000057
1.00

Details

Check Text (C-258591r1136932_chk)

Verify the user role being used for CAC/PKI token VPN client logins is configured with a session timeout. In the ICS Web UI, navigate to Administrators >> Users Roles >> User Roles. 1. Click the configured user role being used for CAC/PKI token VPN client logins. 2. Click the "Session Options" tab. In the "Session Lifetime" section, if Idle Timeout is not set to "10", this is a finding.

Fix Text (F-62240r930460_fix)

Configure the user role being used for CAC/PKI token VPN client logins with a session timeout. In the ICS Web UI, navigate to Administrators >> Users Roles >> User Roles. 1. Click the configured user role being used for CAC/PKI token VPN client logins. 2. Click the "Session Options" tab. 3. In the "Session Lifetime" section, set the Idle Timeout to "10". 4. Click "Save Changes".