The firewall implementation must limit the number of concurrent sessions for each account to an organizationally defined number.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000053-FW-000042	SRG-NET-000053-FW-000042	SRG-NET-000053-FW-000042_rule		Low

Description
This requirement addresses concurrent sessions for a given information system account and does not address concurrent sessions by a single user via multiple accounts. In many products, this value defaults to unlimited which leaves the device open to Denial of Service (DoS) attacks. An organizationally defined value should be configured. Limiting the number of concurrent login sessions to the device per any given account mitigates the risk associated with a DoS attack.

Description

This requirement addresses concurrent sessions for a given information system account and does not address concurrent sessions by a single user via multiple accounts. In many products, this value defaults to unlimited which leaves the device open to Denial of Service (DoS) attacks. An organizationally defined value should be configured. Limiting the number of concurrent login sessions to the device per any given account mitigates the risk associated with a DoS attack.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000053-FW-000042_chk )
View the user account management screens. Verify the number of concurrent sessions setting is not set to unlimited. Verify the number of concurrent sessions is set to an organizationally defined value. If the number of concurrent sessions for accounts is set to unlimited, this is a finding. If the number of concurrent sessions is not set to an organizationally defined value, this is a finding.

Fix Text (F-SRG-NET-000053-FW-000042_fix)
Set the default concurrent sessions for user accounts to an organizationally defined value.