The ALG must generate unique session identifiers using a FIPS 140-2 approved random number generator.
Overview
Finding ID
Version
Rule ID
IA Controls
Severity
V-204960
SRG-NET-000234-ALG-000116
SV-204960r396015_rule
Medium
Description
Sequentially generated session IDs can be easily guessed by an attacker. Employing the concept of randomness in the generation of unique session identifiers helps to protect against brute-force attacks to determine future session identifiers.
This requirement is applicable to ALGs that create and use sessions and session identifiers to control user communications. If an attacker can guess the session identifier, or can inject or manually insert session information, the valid user's application session can be compromised.