The CA API Gateway must invalidate session identifiers upon user logout or other session termination.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-71371	CAGW-GW-000410	SV-85995r1_rule		Medium

Description
Captured sessions can be reused in "replay" attacks. This requirement limits the ability of adversaries from capturing and continuing to employ previously valid session IDs. Session IDs are tokens generated by web applications to uniquely identify an application user's session. Unique session identifiers or IDs are the opposite of sequentially generated session IDs, which can be easily guessed by an attacker. Unique session IDs help to reduce predictability of said identifiers. When a user logs out, or when any other session termination event occurs, the network element must terminate the user session to minimize the potential for an attacker to hijack that particular user session. ALGs act as an intermediary for applications; therefore, session control is part of the function provided. This requirement focuses on communications protection at the application session, rather than at the network packet level. The CA API Gateway must protect against replay attacks by using an out-of-the-box "Protect Against Message Replay" Assertion within the registered services that will assist with validating and invalidating sessions as per organizational requirements.

Description

Captured sessions can be reused in "replay" attacks. This requirement limits the ability of adversaries from capturing and continuing to employ previously valid session IDs. Session IDs are tokens generated by web applications to uniquely identify an application user's session. Unique session identifiers or IDs are the opposite of sequentially generated session IDs, which can be easily guessed by an attacker. Unique session IDs help to reduce predictability of said identifiers. When a user logs out, or when any other session termination event occurs, the network element must terminate the user session to minimize the potential for an attacker to hijack that particular user session. ALGs act as an intermediary for applications; therefore, session control is part of the function provided. This requirement focuses on communications protection at the application session, rather than at the network packet level. The CA API Gateway must protect against replay attacks by using an out-of-the-box "Protect Against Message Replay" Assertion within the registered services that will assist with validating and invalidating sessions as per organizational requirements.

STIG	Date
CA API Gateway ALG Security Technical Implementation Guide	2017-04-07

Details

Check Text ( C-71771r1_chk )
Open the CA API Gateway - Policy Manager and open each of the Registered Services that require the invalidation of session identifiers in order to protect against replay attacks. Verify the "Protect Against Message Replay" Assertion is present after the "Authenticate User or Group" or "Authenticate Against Identity Provider" Assertion. If the Assertion is not present, this is a finding.

Fix Text (F-77685r1_fix)
Open the CA API Gateway - Policy Manager and open each of the Registered Services that did not include the "Protect Against Message Replay" Assertion but that require the protection. Add the "Protect Against Message Replay" Assertion to the policies, configure the Assertion in accordance with organizational requirements, and click "Save and Activate".