The application must automatically terminate the admin user session and log off admin users after a 10 minute idle time period is exceeded.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-222390	APSC-DV-000080	SV-222390r961221_rule		Medium

Description
Leaving an admin user's application session established for an indefinite period of time increases the risk of session hijacking. Session termination terminates an individual user's logical application session after 10 minutes of application inactivity at which time the user must re-authenticate and a new session must be established if the user desires to continue work in the application.

STIG	Date
Application Security and Development Security Technical Implementation Guide	2024-06-05

Details

Check Text ( C-24060r493078_chk )
Ask the application representative to demonstrate the application configuration setting where the idle time out value is defined for admin users. Alternatively, logon with an admin user account and let the session sit idle for 10 minutes. Attempt to access the application after 10 minutes of inactivity. If the configuration setting is not set to time out admin user sessions after 10 minutes of inactivity, or if the session used for testing does not time out after 10 minutes of inactivity, this is a finding.

Check Text ( C-24060r493078_chk )

Ask the application representative to demonstrate the application configuration setting where the idle time out value is defined for admin users.

Alternatively, logon with an admin user account and let the session sit idle for 10 minutes.

Attempt to access the application after 10 minutes of inactivity.

If the configuration setting is not set to time out admin user sessions after 10 minutes of inactivity, or if the session used for testing does not time out after 10 minutes of inactivity, this is a finding.

Fix Text (F-24049r493079_fix)
Design and configure the application to terminate the admin users session after 10 minutes of inactivity.