Free DISA STIG and SRG Library | Vaulted

V-35070

The application server must limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types.

Finding ID
SRG-APP-000001-AS-000001
Rule ID
SV-46335r3_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-APP-000001-AS-000001
CCI
CCI-000054
Target Key
(None)
Documentable
No
Discussion

Application management includes the ability to control the number of sessions that utilize an application by all accounts and/or account types. Limiting the number of allowed sessions is helpful in limiting risks related to Denial of Service attacks. Application servers host and expose business logic and application processes. The application server must possess the capability to limit the maximum number of concurrent sessions in a manner that affects the entire application server or on an individual application basis. Although there is some latitude concerning the settings themselves, the settings should follow DoD-recommended values, but the settings should be configurable to allow for future DoD direction. While the DoD will specify recommended values, the values can be adjusted to accommodate the operational requirement of a given system.

Fix Text

Configure the application server to limit the number of concurrent sessions for all accounts and/or account types to the organization-defined number.

Check Content

Review the application server product documentation and configuration to determine if the number of concurrent sessions can be limited to the organization-defined number of sessions for all accounts and/or account types. If a feature to limit the number of concurrent sessions is not available, is not set, or is set to unlimited, this is a finding.