SharePoint must terminate user sessions upon user logoff, and when idle time limit is exceeded.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-59977	SP13-00-000115	SV-74407r1_rule		High

Description
This requirement focuses on communications protection at the application session, versus network packet level. Session IDs are tokens generated by web applications to uniquely identify an application user's session. Applications will make application decisions and execute business logic based on the session ID. Unique session identifiers or IDs are the opposite of sequentially generated session IDs that can be easily guessed by an attacker. Unique session IDs help to reduce predictability of said identifiers. Unique session IDs address man-in-the-middle attacks, including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions. When a user logs off, or when any other session termination event occurs, the application must terminate the user session to minimize the potential for an attacker to hijack that particular user session.

Description

This requirement focuses on communications protection at the application session, versus network packet level. Session IDs are tokens generated by web applications to uniquely identify an application user's session. Applications will make application decisions and execute business logic based on the session ID. Unique session identifiers or IDs are the opposite of sequentially generated session IDs that can be easily guessed by an attacker. Unique session IDs help to reduce predictability of said identifiers. Unique session IDs address man-in-the-middle attacks, including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions. When a user logs off, or when any other session termination event occurs, the application must terminate the user session to minimize the potential for an attacker to hijack that particular user session.

STIG	Date
SharePoint 2013 Security Technical Implementation Guide	2016-03-25

Details

Check Text ( C-60667r2_chk )
Review the SharePoint server configuration to ensure user sessions are terminated upon user logoff, and when idle time limit is exceeded. Navigate to Central Administration website. Click "Application Management". Click "Manage Web Applications". Repeat the following steps for each web application: -Select the web application. -Click "General Settings" in the "Web Application" ribbon. -In the "Web Page Security Validation" section, verify that "Security Validation is:" is set to "On" and that the "Security Validation Expires:" setting is set to 15 minutes. Otherwise, this is a finding.

Check Text ( C-60667r2_chk )

Review the SharePoint server configuration to ensure user sessions are terminated upon user logoff, and when idle time limit is exceeded.

Navigate to Central Administration website.

Click "Application Management".

Click "Manage Web Applications".

Repeat the following steps for each web application:
-Select the web application.
-Click "General Settings" in the "Web Application" ribbon.
-In the "Web Page Security Validation" section, verify that "Security Validation is:" is set to "On" and that the "Security Validation Expires:" setting is set to 15 minutes.

Otherwise, this is a finding.

Fix Text (F-65387r2_fix)
Configure the SharePoint server to terminate user sessions upon user logoff, and when idle time limit is exceeded. Navigate to Central Administration website. Click "Application Management". Click "Manage Web Applications". Repeat the following steps for each web application: -Select the web application. -Click "General Settings" in the "Web Application" ribbon. -In the "Web Page Security Validation" section, set "Security Validation:" to "On" and that the "Security Validation Expires:" setting is set to 15 minutes.

Fix Text (F-65387r2_fix)

Configure the SharePoint server to terminate user sessions upon user logoff, and when idle time limit is exceeded.

Navigate to Central Administration website.

Click "Application Management".

Click "Manage Web Applications".

Repeat the following steps for each web application:
-Select the web application.
-Click "General Settings" in the "Web Application" ribbon.
-In the "Web Page Security Validation" section, set "Security Validation:" to "On" and that the "Security Validation Expires:" setting is set to 15 minutes.