Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The application server must define the maximum number of concurrent sessions for an application account globally, by account type, by account, or a combination thereof.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-35070 | SRG-APP-000001-AS-000001 | SV-46335r1_rule | Medium |
| Description |
|---|
| Application management includes the ability to control the number of sessions that utilize an application. Limiting the number of allowed sessions is helpful in limiting risks related to Denial of Service attacks. Application servers host and expose business logic and application processes. The application server must possess the capability to limit the maximum number of concurrent sessions in a manner that affects the entire application server or on an individual application basis. The maximum session number values must be configurable so as to meet future DoD requirements that define the maximum number of concurrent sessions. |
| STIG | Date |
|---|---|
| Application Server Security Requirements Guide | 2013-01-08 |
Details
| Check Text ( C-43459r2_chk ) |
|---|
| Review AS product documentation and configuration to determine if the number of concurrent sessions can be limited to an organization defined number of sessions. If a feature to limit the number of concurrent sessions on a per hosted application basis is not configured, this is a finding. |
| Fix Text (F-39623r2_fix) |
|---|
| Configure the AS to limit the number of concurrent sessions per application or per server. |