← Back to Application Security and Development Security Technical Implementation Guide

V-222464

CAT II (Medium)

The application must generate audit records showing starting and ending time for user access to the system.

Rule ID

SV-222464r961830_rule

STIG

Application Security and Development Security Technical Implementation Guide

Version

V6R4

CCIs

CCI-000172

Discussion

Knowing when a user’s application session began and when it ended is critical information that aids in forensic analysis.

Check Content

Review and monitor the application logs.

Initiate a user session and observe if the log includes a time stamp showing the start of the session.

Terminate the user session and observe if the log includes a time stamp showing the end of the session.

If the start and the end time of the session are not recorded in the logs, this is a finding.

Fix Text

Configure the application or application server to record the start and end time of user session activity.