The network device must invalidate session identifiers upon administrator logout or other session termination.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-202075 | SRG-APP-000220-NDM-000268 | SV-202075r1043179_rule | CCI-001185 | medium |
| Description | ||||
| Captured sessions can be reused in "replay" attacks. This requirement limits the ability of adversaries to capture and to continue to employ previously valid session IDs. This requirement is applicable to devices that use a web interface for device management. Session IDs are tokens generated by web applications to uniquely identify an application user's session. Applications will make application decisions and execute business logic based on the session ID. Unique session identifiers or IDs are the opposite of sequentially generated session IDs which can be easily guessed by an attacker. Unique session IDs help to reduce predictability of said identifiers. If a device uses a web interface for device management, when an administrator logs out, or when any other session termination event occurs, the device management web application must invalidate the session identifier to minimize the potential for an attacker to hijack that particular management session. | ||||
| STIG | Date | |||
| Network Device Management Security Requirements Guide | 2025-09-10 | |||
Related Frameworks
1 mapping across 3 frameworks
Related Frameworks
SCF0 mappings
No source states a mapping between these directly.
Also reachable in 3 hops (1) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V5R4intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to
NIST 800-530 mappings
No source states a mapping between these directly.
Also reachable in 2 hops (4) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V5R4intersects(normalised)
- DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)1intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V5R4intersects(normalised)
- DISA STIG Benchmark (XCCDF)3our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)3intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V5R4intersects(normalised)
- DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
- DISA STIG Benchmark (XCCDF)1intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- DISA STIG Benchmark (XCCDF)V5R4intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
CCI1 mapping
CCI-001185
1.00
- DISA STIG Benchmark (XCCDF)V5R4intersects(normalised)
Details
Check Text (C-202075r1043179_chk)
If the network device uses a web interface for device management, determine if the network device invalidates session identifiers upon administrator logout or other session termination. This requirement may be verified by validated test results. If the network device does not invalidate session identifiers upon administrator logout or other session termination, this is a finding.
Fix Text (F-2202r381846_fix)
Configure the network device to invalidate session identifiers upon administrator logout or other session termination.