The application must display the time and date of the users last successful logon.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-69355	APSC-DV-000580	SV-83977r1_rule		Low

Description
Providing a last successful logon date and time stamp notification to the user when they authenticate and access the application allows the user to determine if their application account has been used without their knowledge. Armed with that information, the user can notify the application administrator and initiate a forensics investigation to identify root cause. Without providing this information to the user, a potential compromise of user accounts could go unnoticed.

Description

Providing a last successful logon date and time stamp notification to the user when they authenticate and access the application allows the user to determine if their application account has been used without their knowledge. Armed with that information, the user can notify the application administrator and initiate a forensics investigation to identify root cause. Without providing this information to the user, a potential compromise of user accounts could go unnoticed.

STIG	Date
Application Security and Development Security Technical Implementation Guide	2017-01-09

Details

Check Text ( C-69767r1_chk )
Review the application documentation and interview the application administrator. If the application does not provide a user interface, this requirement is not applicable. Logon to the application as a test user and verify successful authentication by creating test data, navigating the application functionality or otherwise utilizing the application. Note the date and time access was granted. Log out of the application. Re-authenticate to the application as the same user. Validate the last logon date and time is displayed in the user interface. If the date and time the user account was last granted access to the application is not displayed in the user interface, this is a finding.

Check Text ( C-69767r1_chk )

Review the application documentation and interview the application administrator.

If the application does not provide a user interface, this requirement is not applicable.

Logon to the application as a test user and verify successful authentication by creating test data, navigating the application functionality or otherwise utilizing the application.

Note the date and time access was granted.

Log out of the application.

Re-authenticate to the application as the same user.

Validate the last logon date and time is displayed in the user interface.

If the date and time the user account was last granted access to the application is not displayed in the user interface, this is a finding.

Fix Text (F-75529r1_fix)
Design and configure the application to display the date and time when the user was last successfully granted access to the application.