The application must generate audit records when concurrent logons from different workstations occur.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-70423	APSC-DV-003360	SV-85045r1_rule		Low

Description
When an application provides users with the ability to concurrently logon, an event must be recorded that indicates the user has logged on from different workstations. It is important to ensure that audit logs differentiate between the two sessions. The event data must include the user ID, the workstation information and application session information that provides the details necessary to determine which application session executed what action on the system.

Description

When an application provides users with the ability to concurrently logon, an event must be recorded that indicates the user has logged on from different workstations. It is important to ensure that audit logs differentiate between the two sessions. The event data must include the user ID, the workstation information and application session information that provides the details necessary to determine which application session executed what action on the system.

STIG	Date
Application Security and Development Security Technical Implementation Guide	2017-12-18

Details

Check Text ( C-70877r1_chk )
Review the application documentation and interview the application administrator to identify where log records are stored. Access log records then log on to the application as a regular user from one workstation. Take note of workstation IP address and confirm the address as the source workstation. Have the application administrator log on to the application from another workstation using the same account. Validate the IP address of the second workstation is recorded in the logs. If the application does not create an audit record when concurrent logons occur from different workstations, this is a finding.

Check Text ( C-70877r1_chk )

Review the application documentation and interview the application administrator to identify where log records are stored.

Access log records then log on to the application as a regular user from one workstation. Take note of workstation IP address and confirm the address as the source workstation.

Have the application administrator log on to the application from another workstation using the same account.

Validate the IP address of the second workstation is recorded in the logs.

If the application does not create an audit record when concurrent logons occur from different workstations, this is a finding.

Fix Text (F-76659r1_fix)
Configure the application to log concurrent logons from different workstations.