UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The DBMS must limit the number of concurrent sessions for each system account to an organization defined number of sessions.


Overview

Finding ID Version Rule ID IA Controls Severity
V-32157 SRG-APP-000001-DB-000031 SV-42474r1_rule Medium
Description
Application management includes the ability to control the number of users and user sessions utilizing an application. Limiting the number of allowed users, and sessions per user, is helpful in limiting risks related to Denial of Service attacks. This requirement addresses concurrent session control for a single information system account and does not address concurrent sessions by a single user via multiple system accounts. This requirement may be met via the application or by utilizing information system session control provided by a web server with specialized session management capabilities. If it has been specified that this requirement will be handled by the application, the capability to limit the maximum number of concurrent single user sessions must be designed and built into the application. The organization will need to define the maximum number of concurrent sessions for an information system account globally, by account type, by account, or a combination thereof and the application shall enforce that requirement. Unlimited concurrent connections to the DBMS could allow a successful Denial of Service (DoS) attack by exhausting connection resources.
STIG Date
Database Security Requirements Guide 2012-07-02

Details

Check Text ( C-40671r1_chk )
Review settings for concurrent sessions in the DBMS. If the DBMS settings for concurrent sessions for each system account are not lower than or equal to the organization-defined maximum number of sessions, this is a finding.
Fix Text (F-36081r1_fix)
Limit concurrent connections for each system account to a number less than or equal to the organization defined number of sessions.