SC-23 Session authenticity
Requires the authenticity of communications sessions to be protected so that sessions cannot be hijacked, replayed or impersonated between the legitimate parties.
4
artefacts
1
held by a system
1
at each review
moderate
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration evidence for authenticated and integrity protected session establishment · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Test results demonstrating resistance to session fixation and replay · Source control / CI pipeline
governing documentDocuments that govern the control
- Session identifier handling design covering generation, binding and invalidation · Document repository
- Coverage across web, application programming interface and machine to machine sessions · Document repository
First move
Start with the 1 of 4 artefacts that already live in a system (Cloud console / configuration management); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Session identifiers not regenerated after authentication, allowing fixation
- Session tokens transmitted or stored in ways that allow reuse from another context
- Server side invalidation missing, so logout only clears the client
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSC-22 Architecture and provisioning for name/address resolution service · SC-24 Fail in Known State. Fail to a [organization-defined] for the following failures on the indicated components while preserving [organization-defined] in failure: [organization-defined]