1.12.13 Increase the entropy in session identifiers | CIS Apache Tomcat5.5/6.0 L2 v1.0 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
39 - Increase the entropy in session identifiers | TNS Best Practice Jetty 9 Linux | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U1-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - httpd | DISA STIG Apache Server 2.4 Unix Server v2r3 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U1-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - httpd | DISA STIG Apache Server 2.4 Unix Server v2r3 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U1-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - httpd | DISA STIG Apache Server 2.4 Unix Server v2r5 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U1-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - httpd | DISA STIG Apache Server 2.4 Unix Server v2r5 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U1-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - SessionCookieName Domain | DISA STIG Apache Server 2.4 Unix Server v2r3 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U1-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - SessionCookieName Domain | DISA STIG Apache Server 2.4 Unix Server v2r3 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U1-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - SessionCookieName Domain | DISA STIG Apache Server 2.4 Unix Server v2r5 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U1-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - SessionCookieName Domain | DISA STIG Apache Server 2.4 Unix Server v2r5 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U1-000510 - The Apache web server must generate a session ID long enough that it cannot be guessed through brute force - session_crypto | DISA STIG Apache Server 2.4 Unix Server v2r5 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U1-000510 - The Apache web server must generate a session ID long enough that it cannot be guessed through brute force - session_crypto | DISA STIG Apache Server 2.4 Unix Server v3r1 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U1-000510 - The Apache web server must generate a session ID long enough that it cannot be guessed through brute force - SessionCryptoCipher | DISA STIG Apache Server 2.4 Unix Server v2r3 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U1-000510 - The Apache web server must generate a session ID long enough that it cannot be guessed through brute force - SessionCryptoCipher | DISA STIG Apache Server 2.4 Unix Server v2r5 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U1-000510 - The Apache web server must generate a session ID long enough that it cannot be guessed through brute force - SessionCryptoCipher | DISA STIG Apache Server 2.4 Unix Server v2r3 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U1-000510 - The Apache web server must generate a session ID long enough that it cannot be guessed through brute force - SessionCryptoCipher | DISA STIG Apache Server 2.4 Unix Server v3r1 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U1-000510 - The Apache web server must generate a session ID long enough that it cannot be guessed through brute force - SessionCryptoCipher | DISA STIG Apache Server 2.4 Unix Server v2r5 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U1-000510 - The Apache web server must generate a session ID long enough that it cannot be guessed through brute force. | DISA STIG Apache Server 2.4 Unix Server v3r1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U2-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - Header HttpOnly Secure | DISA STIG Apache Server 2.4 Unix Site v2r2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U2-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - Header HttpOnly Secure | DISA STIG Apache Server 2.4 Unix Site v2r1 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U2-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - Header HttpOnly Secure | DISA STIG Apache Server 2.4 Unix Site v2r1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-U2-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application. | DISA STIG Apache Server 2.4 Unix Site v2r4 Middleware | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-W1-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - Javascript setCookie | DISA STIG Apache Server 2.4 Windows Server v2r3 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-W1-000500 - The Apache web server must generate unique session identifiers that cannot be reliably reproduced. | DISA STIG Apache Server 2.4 Windows Server v2r3 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-W1-000530 - The Apache web server must generate unique session identifiers with definable entropy - ssl_module | DISA STIG Apache Server 2.4 Windows Server v2r3 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-W1-000530 - The Apache web server must generate unique session identifiers with definable entropy - SSLRandomSeed connect | DISA STIG Apache Server 2.4 Windows Server v2r3 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-W2-000470 - Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application - Header HttpOnly Secure | DISA STIG Apache Server 2.4 Windows Site v1r3 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-W2-000480 - The Apache web server must accept only system-generated session identifiers. | DISA STIG Apache Server 2.4 Windows Site v1r3 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-W2-000500 - The Apache web server must generate unique session identifiers that cannot be reliably reproduced. | DISA STIG Apache Server 2.4 Windows Site v1r3 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
AS24-W2-000520 - The Apache web server must generate a session ID using as much of the character set as possible to reduce the risk of brute force. | DISA STIG Apache Server 2.4 Windows Site v1r3 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
CASA-VN-000610 - The Cisco ASA remote access VPN server must be configured to generate unique session identifiers using a FIPS-validated Random Number Generator (RNG) based on the Deterministic Random Bit Generators (DRBG) algorithm. | DISA STIG Cisco ASA VPN v2r1 | Cisco | SYSTEM AND COMMUNICATIONS PROTECTION |
DB2X-00-005100 - DB2 must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values | DISA STIG IBM DB2 v10.5 LUW v2r1 OS Windows | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
F5BI-AP-000241 - When the Access Profile Type is LTM+APM and it is not using any connectivity resources (such as Network Access, Portal Access, etc.) in the VPE, the F5 BIG-IP appliance must be configured to enable the HTTP Only flag. | DISA F5 BIG-IP Access Policy Manager STIG v2r3 | F5 | SYSTEM AND COMMUNICATIONS PROTECTION |
F5BI-AP-000242 - The F5 BIG-IP appliance must be configured to enable the 'Secure' cookie flag. | DISA F5 BIG-IP Access Policy Manager STIG v2r3 | F5 | SYSTEM AND COMMUNICATIONS PROTECTION |
F5BI-AP-000243 - The F5 BIG-IP appliance must be configured to disable the 'Persistent' cookie flag. | DISA F5 BIG-IP Access Policy Manager STIG v2r3 | F5 | SYSTEM AND COMMUNICATIONS PROTECTION |
FGFW-ND-000280 - The FortiGate device must generate unique session identifiers using a FIPS 140-2-approved random number generator. | DISA Fortigate Firewall NDM STIG v1r4 | FortiGate | SYSTEM AND COMMUNICATIONS PROTECTION |
IIST-SV-000134 - The IIS 10.0 web server must use cookies to track session state. | DISA IIS 10.0 Server v3r1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
IISW-SI-000201 - The IIS 8.5 website session state must be enabled. | DISA IIS 8.5 Site v1r9 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
IISW-SI-000223 - The IIS 8.5 website must generate unique session identifiers that cannot be reliably reproduced. | DISA IIS 8.5 Site v1r9 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
IISW-SI-000223 - The IIS 8.5 website must generate unique session identifiers that cannot be reliably reproduced. | DISA IIS 8.5 Site v2r1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
IISW-SI-000244 - IIS 8.5 website session IDs must be sent to the client using TLS. | DISA IIS 8.5 Site v1r9 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
IISW-SI-000244 - IIS 8.5 website session IDs must be sent to the client using TLS. | DISA IIS 8.5 Site v2r1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
IISW-SV-000135 - The IIS 8.5 web server must limit the amount of time a cookie persists - timeout | DISA IIS 8.5 Server v1r9 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
IISW-SV-000135 - The IIS 8.5 web server must limit the amount of time a cookie persists - timeout | DISA IIS 8.5 Server v2r1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
MADB-10-004900 - MariaDB must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values. | DISA MariaDB Enterprise 10.x v2r1 DB | MySQLDB | SYSTEM AND COMMUNICATIONS PROTECTION |
MD3X-00-000410 - MongoDB must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values. | DISA STIG MongoDB Enterprise Advanced 3.x v2r3 OS | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
MD4X-00-003700 - MongoDB must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values. | DISA STIG MongoDB Enterprise Advanced 4.x v1r4 OS | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
MYS8-00-007000 - The MySQL Database Server 8.0 must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values. | DISA Oracle MySQL 8.0 v2r1 DB | MySQLDB | SYSTEM AND COMMUNICATIONS PROTECTION |
VCUI-67-000032 - vSphere UI must restrict its cookie path. | DISA STIG VMware vSphere 6.7 UI Tomcat v1r3 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
VCUI-70-000018 - vSphere UI must restrict its cookie path. | DISA STIG VMware vSphere 7.0 vCA UI v1r2 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |