id: "SC-23(01)" title: "Invalidate Session Identifiers at Logout" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-23.01" priority: "P1" implementation_level: "system" parent: "SC-23" enhancement: True
Statement
Invalidate session identifiers upon user logout or other session termination.
Guidance
Invalidating session identifiers at logout curtails the ability of adversaries to capture and continue to employ previously valid session IDs.
Assessment Objective
session identifiers are invalidated upon user logout or other session termination.
System and communications protection policy
procedures addressing session authenticity
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
System/network administrators
organizational personnel with information security responsibilities
Mechanisms supporting and/or implementing session identifier invalidation upon session termination