V-256896

Discussion

Application management includes the ability to control the number of sessions that utilize an application by all accounts and/or account types. Limiting the number of allowed sessions is helpful in limiting risks related to denial-of-service attacks.<br /><br />Automation Controllers host and expose business logic and application processes.<br /><br />Automation Controller limits the maximum number of concurrent sessions in a manner that affects the entire application server or on an individual application basis.<br /><br />The settings must follow DOD-recommended values, but the settings should be configurable to allow for future DOD direction.<br /><br />While the DOD will specify recommended values, the values can be adjusted to accommodate the operational requirement of a given system.<br /><br />Satisfies: SRG-APP-000001-AS-000001, SRG-APP-000295-AS-000263

Check Content

As a System Administrator for each Automation Controller host, navigate to the Automation Controller web administrator console:<br />Settings >> System >> Miscellaneous Authentication settings.<br /><br />Verify the "Maximum Number of simultaneous logged in sessions" field is set according to policy.<br /><br />If this configuration setting does not match the organizationally defined maximum, or is set to -1 (negative one), this is a finding.