CCI|CCI-001188

Title

The information system generates unique session identifiers for each session with organization-defined randomness requirements.

Reference Item Details

Category: 2009

Audit Items

View all Reference Audit Items

NamePluginAudit Name
AS24-U1-000030 - The Apache web server must use cryptography to protect the integrity of remote sessions - ssl_moduleUnixDISA STIG Apache Server 2.4 Unix Server v2r5 Middleware
AS24-U1-000030 - The Apache web server must use cryptography to protect the integrity of remote sessions - ssl_moduleUnixDISA STIG Apache Server 2.4 Unix Server v2r5
AS24-U1-000030 - The Apache web server must use cryptography to protect the integrity of remote sessions - SSLProtocolUnixDISA STIG Apache Server 2.4 Unix Server v2r5
AS24-U1-000030 - The Apache web server must use cryptography to protect the integrity of remote sessions - SSLProtocolUnixDISA STIG Apache Server 2.4 Unix Server v2r5 Middleware
AS24-U1-000510 - The Apache web server must generate a session ID long enough that it cannot be guessed through brute force - session_cryptoUnixDISA STIG Apache Server 2.4 Unix Server v2r5
AS24-U1-000510 - The Apache web server must generate a session ID long enough that it cannot be guessed through brute force - session_cryptoUnixDISA STIG Apache Server 2.4 Unix Server v2r5 Middleware
AS24-U1-000510 - The Apache web server must generate a session ID long enough that it cannot be guessed through brute force - SessionCryptoCipherUnixDISA STIG Apache Server 2.4 Unix Server v2r5 Middleware
AS24-U1-000510 - The Apache web server must generate a session ID long enough that it cannot be guessed through brute force - SessionCryptoCipherUnixDISA STIG Apache Server 2.4 Unix Server v2r5
AS24-U1-000520 - The Apache web server must generate a session ID using as much of the character set as possible to reduce the risk of brute force.UnixDISA STIG Apache Server 2.4 Unix Server v2r5
AS24-U1-000520 - The Apache web server must generate a session ID using as much of the character set as possible to reduce the risk of brute force.UnixDISA STIG Apache Server 2.4 Unix Server v2r5 Middleware
AS24-W1-000480 - The Apache web server must accept only system-generated session identifiers.WindowsDISA STIG Apache Server 2.4 Windows Server v2r2
AS24-W1-000500 - The Apache web server must generate unique session identifiers that cannot be reliably reproduced.WindowsDISA STIG Apache Server 2.4 Windows Server v2r2
AS24-W1-000530 - The Apache web server must generate unique session identifiers with definable entropy - ssl_moduleWindowsDISA STIG Apache Server 2.4 Windows Server v2r2
AS24-W1-000530 - The Apache web server must generate unique session identifiers with definable entropy - SSLRandomSeed connectWindowsDISA STIG Apache Server 2.4 Windows Server v2r2
AS24-W1-000530 - The Apache web server must generate unique session identifiers with definable entropy - SSLRandomSeed startupWindowsDISA STIG Apache Server 2.4 Windows Server v2r2
AS24-W2-000500 - The Apache web server must generate unique session identifiers that cannot be reliably reproduced.WindowsDISA STIG Apache Server 2.4 Windows Site v2r1
AS24-W2-000520 - The Apache web server must generate a session ID using as much of the character set as possible to reduce the risk of brute force.WindowsDISA STIG Apache Server 2.4 Windows Site v2r1
CASA-VN-000610 - The Cisco ASA remote access VPN server must be configured to generate unique session identifiers using a FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm.CiscoDISA STIG Cisco ASA VPN v1r1
DB2X-00-005100 - DB2 must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values - SSLUnixDISA STIG IBM DB2 v10.5 LUW v1r4 OS Linux
DB2X-00-005100 - DB2 must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values - SSLWindowsDISA STIG IBM DB2 v10.5 LUW v1r4 OS Windows
DB2X-00-005100 - DB2 must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values - SSL_SVCENAMEUnixDISA STIG IBM DB2 v10.5 LUW v1r4 OS Linux
DB2X-00-005100 - DB2 must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values - SSL_SVCENAMEWindowsDISA STIG IBM DB2 v10.5 LUW v1r4 OS Windows
DB2X-00-005100 - DB2 must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values - SVCENAMEUnixDISA STIG IBM DB2 v10.5 LUW v1r4 OS Linux
DB2X-00-005100 - DB2 must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values - SVCENAMEWindowsDISA STIG IBM DB2 v10.5 LUW v1r4 OS Windows
DKER-EE-001070 - FIPS mode must be enabled on all Docker Engine - Enterprise nodes - docker info .SecurityOptionsUnixDISA STIG Docker Enterprise 2.x Linux/Unix v2r1
FGFW-ND-000280 - The FortiGate device must generate unique session identifiers using a FIPS 140-2-approved random number generator.FortiGateDISA Fortigate Firewall NDM STIG v1r1
IIST-SI-000220 - A private IIS 10.0 website authentication mechanism must use client certificates to transmit session identifier to assure integrity.WindowsDISA IIS 10.0 Site v2r5
IIST-SI-000223 - The IIS 10.0 website must generate unique session identifiers that cannot be reliably reproduced.WindowsDISA IIS 10.0 Site v2r5
IISW-SI-000220 - A private websites authentication mechanism must use client certificates to transmit session identifier to assure integrity.WindowsDISA IIS 8.5 Site v2r5
IISW-SI-000223 - The IIS 8.5 website must generate unique session identifiers that cannot be reliably reproduced.WindowsDISA IIS 8.5 Site v2r5
MD3X-00-000410 - MongoDB must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.UnixDISA STIG MongoDB Enterprise Advanced 3.x v2r1 OS
MD4X-00-003700 - MongoDB must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.UnixDISA STIG MongoDB Enterprise Advanced 4.x v1r1 OS
SQL6-D0-009200 - SQL Server must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.WindowsDISA STIG SQL Server 2016 Instance OS Audit v2r7
TCAT-AS-000750 - Tomcat must use FIPS-validated ciphers on secured connectors.UnixDISA STIG Apache Tomcat Application Server 9 v2r4 Middleware
TCAT-AS-000750 - Tomcat must use FIPS-validated ciphers on secured connectors.UnixDISA STIG Apache Tomcat Application Server 9 v2r4
WBSP-AS-001290 - WebSphere Application Server must utilize FIPS 140-2-approved encryption modules when authenticating users and processes.UnixDISA IBM WebSphere Traditional 9 STIG v1r1 Middleware
WBSP-AS-001290 - WebSphere Application Server must utilize FIPS 140-2-approved encryption modules when authenticating users and processes.WindowsDISA IBM WebSphere Traditional 9 Windows STIG v1r1
WBSP-AS-001290 - WebSphere Application Server must utilize FIPS 140-2-approved encryption modules when authenticating users and processes.UnixDISA IBM WebSphere Traditional 9 STIG v1r1