Detections
Analytics

2.5 Ensure 'cookie protection mode' is configured for forms authentication - Default

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The cookie protection mode defines the protection Forms Authentication cookies will be given within a configured application. The four cookie protection modes that can be defined are:
 * Encryption and validation - Specifies that the application use both data validation and encryption to help protect the cookie; this option uses the configured data validation algorithm (based on the machine key) and triple-DES (3DES) for encryption, if available and if the key is long enough (48 bytes or more)
 * None - Specifies that both encryption and validation are disabled for sites that are using cookies only for personalization and have weaker security requirements
 * Encryption - Specifies that the cookie is encrypted by using Triple-DES or DES, but data validation is not performed on the cookie; cookies used in this manner might be subject to plain text attacks
 * Validation - Specifies that a validation scheme verifies that the contents of an encrypted cookie have not been changed in transit
 It is recommended that cookie protection mode always encrypt and validate Forms Authentication cookies.
 Rationale:
 By encrypting and validating the cookie, the confidentiality and integrity of data within the cookie is assured. This helps mitigate the risk of attacks such as session hijacking and impersonation.

 NOTE: This requires .Net Extensibility or ASPNET45 component, but neiter component was not found.

Solution

Cookie protection mode can be configured by using the user interface (UI), by running Appcmd.exe commands in a command-line window, by editing configuration files directly, or by writing WMI scripts. Using IIS Manager:
 1. Open IIS Manager and navigate to the level where Forms Authentication is enabled
 2. In Features View, double-click Authentication
 3. On the Authentication page, select Forms Authentication
 4. In the Actions pane, click Edit
 5. In the Cookie settings section, verify the drop-down for Protection mode is set for Encryption and validation
 Default Value:
 When cookies are used for Forms Authentication, the default cookie protection mode is All, meaning the application encrypts and validates the cookie.

See Also

https://workbench.cisecurity.org/files/2220

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-28, CSCv7|18

Plugin: Windows

Control ID: be8863feb506354f1e8e8f64a231610d8434a25cdcbdd8225576bb9c6cdcc70f