The application server management interface must ensure that users can directly initiate session lock mechanisms which prevent further access to the system.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35452	SRG-APP-000004-AS-NA	SV-46739r1_rule		Medium

Description
A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. The session lock is implemented at the point where session activity can be determined. This is typically at the operating system level, but may be at the application level. Rather than be forced to wait for a period of time to pass before the user session can be locked, applications need to provide users with the ability to manually invoke a session lock so users may secure their application should the need arise for them to temporarily vacate the immediate physical vicinity. This requirement relates to screen locks. The application server user interface is web-based and will utilize the OS controls to detect periods of inactivity that require the session lock to be activated. This requirement is better met by OS controls.

Description

A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. The session lock is implemented at the point where session activity can be determined. This is typically at the operating system level, but may be at the application level. Rather than be forced to wait for a period of time to pass before the user session can be locked, applications need to provide users with the ability to manually invoke a session lock so users may secure their application should the need arise for them to temporarily vacate the immediate physical vicinity. This requirement relates to screen locks. The application server user interface is web-based and will utilize the OS controls to detect periods of inactivity that require the session lock to be activated. This requirement is better met by OS controls.

STIG	Date
Application Server Security Requirements Guide	2013-01-08

Details

Check Text ( C-43806r1_chk )
This requirement is NA for the AS SRG.

Fix Text (F-39996r1_fix)
This requirement is NA. No fix is required.