OpenControls Logo

STIG Viewer

STIGViewer Support

The network device must be configured to enable network administrators to directly initiate a session lock.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-202008SRG-APP-000004-NDM-000203SV-202008r984087_ruleCCI-000057medium
Description
A session lock is a temporary network device or administrator-initiated action taken when the administrator stops work but does not log out of the network device. Rather than being forced to wait for a period of time to expire before the management session can be locked, network management consoles must provide administrators with the ability to manually invoke a session lock so they may secure their management session should the need arise for them to temporarily vacate the immediate physical vicinity of the management workstation. Once invoked, the session lock shall remain in place until the administrator re-authenticates. No other system activity aside from re-authentication shall unlock the management session. The session lock is implemented at the point where session activity can be determined. This is typically at the operating system-level, but may be at the application-level. The session lock is initiated and controlled by either the client application or the workstation being used to access a network element. Many terminal emulation clients implement this capability through software flow control or XOFF/XON flow control. If this capability is not available, administrators must terminate all management sessions before leaving their management console or workstation. This includes closing any views or windows from those sessions.
STIGDate
Network Device Management Security Requirements Guide2025-09-10

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-24Session Lock
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (18) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-11Device Lock
1.00
AC-11(1)Pattern-hiding Displays
1.00
AC-12Session Termination
1.00
AC-12(2)Termination Message
1.00
AU-10Non-repudiation
1.00
CM-7Least Functionality
1.00
IA-11Re-authentication
1.00
IA-2Identification and Authentication (Organizational Users)
1.00
IA-2(1)Multi-factor Authentication to Privileged Accounts
1.00
IA-2(12)Acceptance of PIV Credentials
1.00

+8 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.10
1.00
CCI1 mapping
CCI-000057
1.00

Details

Check Text (C-202008r984087_chk)

Directly observe the management application or the console; if an administrator cannot directly initiate a session lock from either the management application or the console, this is a finding.

Fix Text (F-2135r984086_fix)

This is an intrinsic capability of the client application or the console. Many terminal emulation clients implement this capability through software flow control or XOFF/XON flow control.