[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsc-23":3},{"item":4,"lessons":18,"controls":56,"related":84},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sc-23","SC-23","Session Authenticity",9,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The authenticity of communications sessions must be protected.\n\n**In practice.** This is about making sure each party in a session is who it claims to be and that the session cannot be hijacked or replayed. In practice that means mutual or server authentication through TLS, secure session token handling in web applications, binding tokens to sessions and invalidating sessions on logout. Auditors look for TLS configurations, application security testing results and session management standards. Short-lived tokens and detection of session reuse from unusual locations add protection.\n\n**Common gaps.** Web applications with predictable or poorly protected session tokens remain common. Stolen session cookies are increasingly used to bypass multi-factor authentication, and few organisations detect that. Internal service-to-service traffic is also seldom authenticated.","Protect the authenticity of communications sessions.\nDiscussion: Protecting session authenticity addresses communications protection at the session level, not at the packet level. Such protection establishes grounds for confidence at both ends of communications sessions in the ongoing identities of other parties and the validity of transmitted information. Authenticity protection includes protecting against \"man-in-the-middle\" attacks, session hijacking, and the insertion of false information into sessions.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52],{"slug":21,"title":22,"published_at":23},"critical-auth-flaws-in-ev-charging-app-enable-full-admin-takeover","Critical Auth Flaws in EV Charging App Enable Full Admin Takeover","2026-10-01T18:22:05.631+00:00",{"slug":25,"title":26,"published_at":27},"wordpress-csrf-flaw-enables-remote-php-execution-via-admin-trick","WordPress CSRF Flaw Enables Remote PHP Execution via Admin Trick","2026-09-21T20:20:30.767+00:00",{"slug":29,"title":30,"published_at":31},"bgp-hijack-delivers-malicious-virtualizor-update-via-compromised-update-infrastructure","BGP Hijack Delivers Malicious Virtualizor Update via Compromised Update Infrastructure","2026-09-01T16:20:26.621+00:00",{"slug":33,"title":34,"published_at":35},"android-17-brings-os-wide-encryption-to-shield-dns-queries-from-network-providers","Android 17 Brings OS-Wide Encryption to Shield DNS Queries from Network Providers","2026-08-28T20:21:38.909+00:00",{"slug":37,"title":38,"published_at":39},"critical-vulnerabilities-in-ase2000-v2-test-set-expose-ics-networks-to-file-network-and-mitm-attacks","Critical Vulnerabilities in ASE2000 V2 Test Set Expose ICS Networks to File, Network, and MITM Attacks","2026-08-27T18:23:00.075+00:00",{"slug":41,"title":42,"published_at":43},"ai-reasoning-apis-leaked-secrets-via-replayable-encrypted-objects","AI Reasoning APIs Leaked Secrets via Replayable Encrypted Objects","2026-08-12T14:21:27.218+00:00",{"slug":45,"title":46,"published_at":47},"agentic-browsers-vulnerable-to-social-engineering-via-pleasefix-flaws","Agentic Browsers Vulnerable to Social Engineering via 'PleaseFix' Flaws","2026-07-28T12:22:16.447+00:00",{"slug":49,"title":50,"published_at":51},"critical-auth-flaws-in-ev-charging-station-management-system-enable-unauthorized-admin-access","Critical Auth Flaws in EV Charging Station Management System Enable Unauthorized Admin Access","2026-06-25T19:20:21.778+00:00",{"slug":53,"title":54,"published_at":55},"chromes-device-bound-sessions-combat-cookie-theft-attacks","Chrome's Device-Bound Sessions Combat Cookie Theft Attacks","2026-04-10T08:08:22.683+00:00",[57,62,67,72,76,80],{"slug":58,"name":59,"problem":60,"stories":61},"patch-management","Automated patch management","Known holes get closed in days, not months.",4,{"slug":63,"name":64,"problem":65,"stories":66},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",3,{"slug":68,"name":69,"problem":70,"stories":71},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",2,{"slug":73,"name":74,"problem":75,"stories":71},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":77,"name":78,"problem":79,"stories":71},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":81,"name":82,"problem":83,"stories":71},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[85,91,95,99,104,108,112,116],{"family":86,"item":87,"code":88,"title":89,"together":90},"cis","7","Control 7","Continuous Vulnerability Management",5,{"family":86,"item":92,"code":93,"title":94,"together":90},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":86,"item":96,"code":97,"title":98,"together":61},"2","Control 2","Inventory and Control of Software Assets",{"family":100,"item":101,"code":102,"title":103,"together":61},"gdpr","32","Article 32","Security of processing",{"family":86,"item":105,"code":106,"title":107,"together":61},"12","Control 12","Network Infrastructure Management",{"family":86,"item":109,"code":110,"title":111,"together":71},"13","Control 13","Network Monitoring and Defense",{"family":86,"item":113,"code":114,"title":115,"together":71},"16","Control 16","Application Software Security",{"family":86,"item":117,"code":118,"title":119,"together":71},"6","Control 6","Access Control Management"]