SC-23 Session Authenticity
Review SC-23
1. Set its parameters
No parameters to set for SC-23.
2. Record its status
Protect the authenticity of communications sessions.
Discussion
Protecting session authenticity addresses communications protection at the session level, not at the packet level. Such protection establishes grounds for confidence at both ends of communications sessions in the ongoing identities of other parties and the validity of transmitted information. Authenticity protection includes protecting against "man-in-the-middle" attacks, session hijacking, and the insertion of false information into sessions.
Enhancements
Review SC-23(1)
1. Set its parameters
No parameters to set for SC-23(1).
2. Record its status
Invalidate session identifiers upon user logout or other session termination.
Discussion
Invalidating session identifiers at logout curtails the ability of adversaries to capture and continue to employ previously valid session IDs.
Review SC-23(3)
1. Set its parameters
No parameters to set for SC-23(3).
2. Record its status
Generate a unique session identifier for each session with [Assignment: organization-defined randomness requirements] and recognize only session identifiers that are system-generated.
Discussion
Generating unique session identifiers curtails the ability of adversaries to reuse previously valid session IDs. Employing the concept of randomness in the generation of unique session identifiers protects against brute-force attacks to determine future session identifiers.
Review SC-23(5)
1. Set its parameters
No parameters to set for SC-23(5).
2. Record its status
Only allow the use of [Assignment: organization-defined certificated authorities] for verification of the establishment of protected sessions.
Discussion
Reliance on certificate authorities for the establishment of secure sessions includes the use of Transport Layer Security (TLS) certificates. These certificates, after verification by their respective certificate authorities, facilitate the establishment of protected sessions between web clients and web servers.
No Enhancements match this Baseline.
ISO/IEC 27001:2022 Crosswalk
No ISO 27001 mapping published for this control.