[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fac-12":3},{"item":4,"lessons":18,"controls":68,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ac-12","AC-12","Session Termination",19,"US National Institute of Standards and Technology (NIST)","**What it asks for.** User sessions must be automatically terminated after defined conditions or trigger events, such as inactivity or targeted attack responses.\n\n**In practice.** Doing this well means session timeouts in applications and identity providers sized to risk, session revocation when accounts are disabled or compromised, and limits on token lifetimes. Auditors look for configured timeouts, token lifetime settings and evidence that session revocation works during incident response. Identity platforms can use continuous access evaluation to end sessions when risk changes. Remote access and privileged sessions deserve shorter limits than ordinary use.\n\n**Common gaps.** Long-lived tokens and refresh tokens often survive password resets, so attackers keep access. Timeouts are set generously to reduce user friction and rarely revisited. Applications built in-house sometimes do not invalidate sessions on the server side at all.","Automatically terminate a user session after [Assignment: organization-defined conditions or trigger events].\nDiscussion: Session termination addresses the termination of user-initiated logical sessions (in contrast to [SC-10](#sc-10) , which addresses the termination of network connections associated with communications sessions (i.e., network disconnect)). A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user) accesses an organizational system. Such user sessions can be terminated without terminating network sessions. Session termination ends all processes associated with a user’s logical session except for those processes that are specifically created by the user (i.e., session owner) to continue after the session is terminated. Conditions or trigger events that require automatic termination of the session include organization-defined periods of user inactivity, targeted responses to certain types of incidents, or time-of-day restrictions on system use.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"session-hijacking-bypasses-mfa-as-top-identity-threat","Session Hijacking Bypasses MFA as Top Identity Threat","2026-09-10T16:22:56.996+00:00",{"slug":25,"title":26,"published_at":27},"jsceal-malware-hijacks-google-sessions-via-stolen-browser-cookies","JSCeal Malware Hijacks Google Sessions via Stolen Browser Cookies","2026-09-07T10:20:42.322+00:00",{"slug":29,"title":30,"published_at":31},"jewelbug-group-compromises-government-webmail-via-cookie-theft-and-backdoor-implants","Jewelbug Group Compromises Government Webmail via Cookie Theft and Backdoor Implants","2026-08-13T20:20:20.393+00:00",{"slug":33,"title":34,"published_at":35},"ai-reasoning-apis-leaked-secrets-via-replayable-encrypted-objects","AI Reasoning APIs Leaked Secrets via Replayable Encrypted Objects","2026-08-12T14:21:27.218+00:00",{"slug":37,"title":38,"published_at":39},"mikrotik-routeros-session-flaw-exposes-wireguard-private-keys","MikroTik RouterOS Session Flaw Exposes WireGuard Private Keys","2026-07-30T19:21:17.215+00:00",{"slug":41,"title":42,"published_at":43},"acr-stealer-exploits-clickfix-social-engineering-to-harvest-browser-tokens-and-m365-data","ACR Stealer Exploits ClickFix Social Engineering to Harvest Browser Tokens and M365 Data","2026-07-17T12:21:45.38+00:00",{"slug":45,"title":46,"published_at":47},"china-linked-group-exploits-unpatched-roundcube-to-target-university-research","China-Linked Group Exploits Unpatched Roundcube to Target University Research","2026-07-08T12:20:24.867+00:00",{"slug":49,"title":50,"published_at":51},"state-sponsored-group-exploits-stolen-session-tokens-for-enterprise-espionage","State-Sponsored Group Exploits Stolen Session Tokens for Enterprise Espionage","2026-06-11T18:21:02.933+00:00",{"slug":53,"title":54,"published_at":55},"sophisticated-browser-in-the-browser-phishing-campaign-exploits-user-trust","Sophisticated Browser-in-the-Browser Phishing Campaign Exploits User Trust","2026-06-08T23:20:27.036+00:00",{"slug":57,"title":58,"published_at":59},"openai-enhances-chatgpt-security-with-account-controls-and-data-protection-features","OpenAI Enhances ChatGPT Security with Account Controls and Data Protection Features","2026-06-08T10:20:16.578+00:00",{"slug":61,"title":62,"published_at":63},"brute-force-attack-bypasses-2fa-controls-at-password-manager","Brute-Force Attack Bypasses 2FA Controls at Password Manager","2026-06-02T06:05:27.627+00:00",{"slug":65,"title":66,"published_at":67},"storm-infostealer-evades-detection-through-server-side-decryption","Storm Infostealer Evades Detection Through Server-Side Decryption","2026-04-13T19:09:44.657+00:00",[69,74,78,83,87,92],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",10,{"slug":75,"name":76,"problem":77,"stories":73},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":79,"name":80,"problem":81,"stories":82},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",6,{"slug":84,"name":85,"problem":86,"stories":82},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":88,"name":89,"problem":90,"stories":91},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",5,{"slug":93,"name":94,"problem":95,"stories":96},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",4,[98,103,109,113,117,121,125,129],{"family":99,"item":100,"code":101,"title":102,"together":73},"cis","6","Control 6","Access Control Management",{"family":104,"item":105,"code":106,"title":107,"together":108},"gdpr","32","Article 32","Security of processing",8,{"family":5,"item":110,"code":111,"title":112,"together":82},"si-4","SI-4","System Monitoring",{"family":99,"item":114,"code":115,"title":116,"together":82},"8","Control 8","Audit Log Management",{"family":5,"item":118,"code":119,"title":120,"together":91},"ac-2","AC-2","Account Management",{"family":99,"item":122,"code":123,"title":124,"together":91},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":5,"item":126,"code":127,"title":128,"together":91},"ia-2","IA-2","Identification and Authentication (Organizational Users)",{"family":99,"item":130,"code":131,"title":120,"together":96},"5","Control 5"]