V-204750
Application Server Security Requirements Guide
Title
The application server must disable identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
Description
<VulnDiscussion>Inactive identifiers pose a risk to systems and applications. Attackers that are able to exploit an inactive identifier can potentially obtain and maintain undetected access to the application. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Applications need to track periods of inactivity and disable application identifiers after 35 days of inactivity. Management of user identifiers is not applicable to shared infor...
Fix Text (Documentation Requirement)
Configure the application server to disable identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.