THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · SC-23

Session Authenticity

US National Institute of Standards and Technology (NIST) · cited in 9 of our lessons

Explanation

What it asks for. The authenticity of communications sessions must be protected.

In practice. This is about making sure each party in a session is who it claims to be and that the session cannot be hijacked or replayed. In practice that means mutual or server authentication through TLS, secure session token handling in web applications, binding tokens to sessions and invalidating sessions on logout. Auditors look for TLS configurations, application security testing results and session management standards. Short-lived tokens and detection of session reuse from unusual locations add protection.

Common gaps. Web applications with predictable or poorly protected session tokens remain common. Stolen session cookies are increasingly used to bypass multi-factor authentication, and few organisations detect that. Internal service-to-service traffic is also seldom authenticated.

Open SP 800-53 at NIST
The official text
Protect the authenticity of communications sessions. Discussion: Protecting session authenticity addresses communications protection at the session level, not at the packet level. Such protection establishes grounds for confidence at both ends of communications sessions in the ongoing identities of other parties and the validity of transmitted information. Authenticity protection includes protecting against "man-in-the-middle" attacks, session hijacking, and the insertion of false information into sessions.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered.