The WLAN inactive session timeout must be set for 30 minutes or less.

From WLAN Controller Security Technical Implementation Guide (STIG)

Part of WLAN session timeout set to 30 minutes or less

SV-15656r1_rule The WLAN inactive session timeout must be set for 30 minutes or less.

Vulnerability discussion

A WLAN session that never terminates due to inactivity may allow an opening for an adversary to highjack the session to obtain access to the network.

Check content

1. Review the relevant configuration screen of the WLAN controller or access point. 2. Verify the session timeout setting is set for 30 minutes or less. 4. Mark as a finding if any of the following are found. - Session timeout is not set to 30 minutes or less for the entire WLAN. - The WLAN does not have the capability to enable the session time-out feature.

Fix text

Set the WLAN inactive session timeout to 30 minutes or less.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.