STIGQter: STIG Summary: AvePoint Compliance Guardian Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 15 Mar 2023:

Compliance Guardian must initiate a session timeout after a 15-minute period of inactivity.

DISA Rule

SV-256840r890130_rule

Vulnerability Number

V-256840

Group Title

SRG-APP-000003

Rule Version

APCG-00-000005

Severity

CAT II

CCI(s)

CCI-000057 - The information system initiates a session lock after the organization-defined time period of inactivity.

Weight

Fix Recommendation

Configure the Compliance Guardian Manager Session Timeout setting.
- Log on to Compliance Guardian with admin account.
- On the Control Panel page, in the System Configuration section, click "General Settings".
- Select "Security - System Security Policy".
- Set 15 minutes or less in the "Please specify a session time-out value". The user will be logged off automatically if there is no activity for the specified period. Logon will expire in option.
- Save the settings.

Check Contents

Check the Compliance Guardian Manager Session Timeout setting.
- Log on to Compliance Guardian with admin account.
- On the Control Panel page, in the System Configuration section, click "General Settings".
- Select "Security - System Security Policy".
- Verify the "Please specify a session time-out value". The user will be logged off automatically if there is no activity for the specified period. Logon will expire in option.

If the session timeout value is not set to 15 minutes or less, this is a finding.

Vulnerability Number

V-256840

Documentable

False

Rule Version

APCG-00-000005

Severity Override Guidance

Check Content Reference

Target Key

5531