The DBMS must terminate user sessions upon user logout or any other organization or policy defined session termination events, such as idle time limit exceeded.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32523	SRG-APP-000220-DB-000149	SV-42860r1_rule		Medium

Description
This requirement focuses on communications protection at the application session, versus network packet level. Session IDs are tokens generated by web applications to uniquely identify an application user's session. Applications will make application decisions and execute business logic based on the session ID. Unique session identifiers or IDs are the opposite of sequentially generated session IDs which can be easily guessed by an attacker. Unique session IDs help to reduce predictability of said identifiers. Unique session IDs address man-in-the-middle attacks including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions. When a user logs out, or when any other session termination event occurs, the application must terminate the user session to minimize the potential for an attacker to hijack that particular user session. Database sessions must be terminated when no longer in use in order to prevent session hijacking.

Description

This requirement focuses on communications protection at the application session, versus network packet level. Session IDs are tokens generated by web applications to uniquely identify an application user's session. Applications will make application decisions and execute business logic based on the session ID. Unique session identifiers or IDs are the opposite of sequentially generated session IDs which can be easily guessed by an attacker. Unique session IDs help to reduce predictability of said identifiers. Unique session IDs address man-in-the-middle attacks including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions. When a user logs out, or when any other session termination event occurs, the application must terminate the user session to minimize the potential for an attacker to hijack that particular user session. Database sessions must be terminated when no longer in use in order to prevent session hijacking.

STIG	Date
Database Security Requirements Guide	2012-07-02

Details

Check Text ( C-40961r2_chk )
Review DBMS settings and vendor documentation to verify user sessions are terminated upon user logout. If they are not, this is a finding. Review system documentation and organization policy to identify other events that should result in session terminations. If other session termination events are defined, review DBMS settings to verify occurrences of these events would cause session termination. If occurrences of defined session terminating events do not cause session terminations, this is a finding.

Check Text ( C-40961r2_chk )

Review DBMS settings and vendor documentation to verify user sessions are terminated upon user logout. If they are not, this is a finding.

Review system documentation and organization policy to identify other events that should result in session terminations. If other session termination events are defined, review DBMS settings to verify occurrences of these events would cause session termination. If occurrences of defined session terminating events do not cause session terminations, this is a finding.

Fix Text (F-36438r1_fix)
Configure DBMS settings to terminate sessions upon user logout. Configure DBMS settings to terminate sessions upon the occurrence of any organization or policy defined session termination event.