OWASP
1.3.3 - Handling Session Termination with SSO (Documentation)
Proposal for handling session termination with SSO and other systems:
| # | Description | L1 | L2 | L3 |
|---|---|---|---|---|
| 1.3.3 | Verify that all session granting systems (such as SSO applications) are documented along with controls to propagate session termination across all such systems. | ✓ | ✓ | ✓ |
is this linked to section 3.6? Would it be worth preparing matching/complementary requirements for both sections 1.3 and 3.6? @ryarmst
@tghosth Do you mean for 1.3 items to reference requirements in V3 or for there to be something like an in-order alignment between 1.3 and V3 sections?
My guess is that Josh pointed to section "V3.6 Federated Re-authentication".
Yes, but my question is: what form should complementary requirements take? This is of course related to V3.6.
Really sorry my original point was not super clear @ryarmst, my point was that 1.x is designed for documentation requirements so my question was whether there should be a matching implementation requirement in chapter 3.x and whether there were any other documentation/implementation requirement pairs needed between these chapters.
@tghosth We did not come to a precise conclusion following further discussion, but this is a reformulated attempt to meet 3.6.1 needs. Proposal:
| # | Description | L1 | L2 | L3 |
|---|---|---|---|---|
| 1.3.3 | Verify that all session granting systems (such as SSO applications) are documented along with associated session timeouts and controls to propagate session termination across all such systems. | ✓ | ✓ | ✓ |
Currently, 3.6.1 uses the terminology "maximum authentication time" which I will suggest updating for clarity dependent on this requirement's evolution.
So it feels like it is in the right direction but I find it a little confusing because the terminology in 1.3.3 seems very different to the terminology in 3.6.x, do you understand what I mean?
@tghosth please consider the following in conjunction with #1190:
| # | Description | L1 | L2 | L3 |
|---|---|---|---|---|
| 1.3.3 | Verify that all systems that create and manage user sessions as part of a federated identity management ecosystem (such as SSO systems) are documented along with controls to coordinate session lifetimes and termination, requiring re-authentication. | ✓ | ✓ | ✓ |
Considering in addition (separately) section text to reference NIST Federation and Assertions.
...along with controls to coordinate session lifetimes and termination, requiring re-authentication.
The wording of this last bit seems weird, especially the part after the comma, could you rephrase?
@tghosth Agreed, try this:
| L1 | L2 | L3 |
|---|---|---|
| 1.3.3 | Verify that all systems that create and manage user sessions as part of a federated identity management ecosystem (such as SSO systems) are documented along with controls to coordinate session lifetimes, termination, and any other condition that should require re-authentication. | ✓ |