← Back to Network Device Management Security Requirements Guide

V-202009

CAT II (Medium)

The network device must retain the session lock until the administrator reestablishes access using established identification and authentication procedures.

Rule ID

SV-202009r960747_rule

STIG

Network Device Management Security Requirements Guide

Version

V5R4

CCIs

CCI-000056

Discussion

A session lock is a temporary network device or administrator-initiated action taken when the administrator stops work but does not log out of the network device. Once invoked, the session lock shall remain in place until the administrator re-authenticates. No other system activity aside from re-authentication shall unlock the management session.

Check Content

Review the network device configuration to determine if the device retains session lock until the administrator re-authenticates.  This may be verified by configuration check, demonstration, or other validation test results. If the device does not require re-authentication before releasing the session lock, this is a finding.

Fix Text

Configure the network device to retain session lock until the administrator re-authenticates.