SC-23 Session Authenticity
System and Communications Protection
Description
Protect the authenticity of communications sessions.
Supplemental Guidance
Protecting session authenticity addresses communications protection at the session level, not at the packet level. Such protection establishes grounds for confidence at both ends of communications sessions in the ongoing identities of other parties and the validity of transmitted information. Authenticity protection includes protecting against "man-in-the-middle" attacks, session hijacking, and the insertion of false information into sessions.
Enhancements (3)
What NIST adds to this control. Select one to read its statement.
SC-23(01) Invalidate Session Identifiers at Logout
Invalidate session identifiers upon user logout or other session termination.
SC-23(03) Unique System-generated Session Identifiers
Generate a unique session identifier for each session with [Assignment: organization-defined randomness requirements] and recognize only session identifiers that are system-generated.
SC-23(05) Allowed Certificate Authorities
Only allow the use of [Assignment: organization-defined certificate authorities] for verification of the establishment of protected sessions.
Patterns that use this control (12)
Grouped by the emphasis each pattern gives it.
Critical (3)
Important (6)
MITRE ATT&CK Techniques (20)
ATT&CK v16.1Techniques mitigated by this control, mapped via CTID.