id: "SC-23(03)" title: "Unique System-generated Session Identifiers" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-23.03" priority: "P1" implementation_level: "system" parent: "SC-23" enhancement: True
Statement
Generate a unique session identifier for each session with {{ insert: param, sc-23.03_odp }} and recognize only session identifiers that are system-generated.
Guidance
Generating unique session identifiers curtails the ability of adversaries to reuse previously valid session IDs. Employing the concept of randomness in the generation of unique session identifiers protects against brute-force attacks to determine future session identifiers.
Assessment Objective: a unique session identifier is generated for each session with {{ insert: param, sc-23.03_odp }};
Assessment Objective: only system-generated session identifiers are recognized.
System and communications protection policy
procedures addressing session authenticity
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
System/network administrators
organizational personnel with information security responsibilities
Mechanisms supporting, implementing, generating, and monitoring unique session identifiers
mechanisms supporting and/or implementing randomness requirements