AC-11: SESSION LOCK

TAILORED FOR INDUSTRIAL CONTROL SYSTEMS

• ISC Control Baseline:

• Moderate
• High

• a. Prevents further access to the system by initiating a session lock after [Assignment: organization-defined time period] of inactivity or upon receiving a request from a user; and
• b. Retains the session lock until the user reestablishes access using established identification and authentication procedures.

SUPPLEMENTAL GUIDANCE

Session locks are temporary actions taken when users stop work and move away from the immediate vicinity of information systems but do not want to log out because of the temporary nature of their absences. Session locks are implemented where session activities can be determined. This is typically at the operating system level, but can also be at the application level. Session locks are not an acceptable substitute for logging out of information systems, for example, if organizations require users to log out at the end of workdays.

ICS SUPPLEMENTAL GUIDANCE

This control assumes a staffed environment where users interact with information system displays. When this assumption does not apply the organization tailors the control appropriately (e.g., the ICS may be physically protected by placement in a locked enclosure). The control may also be tailored for ICS that are not configured with displays, but which have the capability to support displays (e.g., ICS to which a maintenance technician may attach a display). In some cases, session lock for ICS operator workstations/nodes is not advised (e.g., when immediate operator responses are required in emergency situations). Example compensating controls include locating the display in an area with physical access controls that limit access to individuals with permission and need-to-know for the displayed information.

CONTROL ENHANCEMENTS

AC-11 (1) SESSION LOCK | PATTERN-HIDING DISPLAYS

• ISC Control Baseline:

• Moderate
• High

The information system conceals, via the session lock, information previously visible on the display with a publicly viewable image.

Supplemental Guidance:

Publicly viewable images can include static or dynamic images, for example, patterns used with screen savers, photographic images, solid colors, clock, battery life indicator, or a blank screen, with the additional caveat that none of the images convey sensitive information.

ICS Supplemental Guidance:

ICS may employ physical protection to prevent access to a display or to prevent attachment of a display. In situations where the ICS cannot conceal displayed information, the organization employs nonautomated mechanisms or procedures as compensating controls in accordance with the general tailoring guidance.

REFERENCES:

• NIST Special Publication 800-82
• OMB Memorandum 06-16