V-222566
Application Security and Development Security Technical Implementation Guide
Title
The application must terminate all sessions and network connections when nonlocal maintenance is completed.
Description
<VulnDiscussion>If a maintenance session or connection remains open after maintenance is completed, it may be hijacked by an attacker and used to compromise or damage the system. Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the info...
Fix Text (Documentation Requirement)
Configure the application to expire idle user sessions after 10 minutes of inactivity for admin users and after 15 minutes of inactivity for regular users.