Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The ALG must generate unique session identifiers using a FIPS 140-2 approved random number generator.
Description
Discussion Text
Sequentially generated session IDs can be easily guessed by an attacker. Employing the concept of randomness in the generation of unique session identifiers helps to protect against brute-force attacks to determine future session identifiers.
This requirement is applicable to ALGs that create and use sessions and session identifiers to control user communications. If an attacker can guess the session identifier, or can inject or manually insert session information, the valid user's application session can be compromised.
This requirement is applicable to ALGs that create and use sessions and session identifiers to control user communications. If an attacker can guess the session identifier, or can inject or manually insert session information, the valid user's application session can be compromised.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.