The application must display the time and date of the users last successful logon.

From Application Security and Development Security Technical Implementation Guide

Part of APSC-DV-000580

Associated with: CCI-000052

SV-83977r1_rule The application must display the time and date of the users last successful logon.

Vulnerability discussion

Providing a last successful logon date and time stamp notification to the user when they authenticate and access the application allows the user to determine if their application account has been used without their knowledge. Armed with that information, the user can notify the application administrator and initiate a forensics investigation to identify root cause. Without providing this information to the user, a potential compromise of user accounts could go unnoticed.

Check content

Review the application documentation and interview the application administrator. If the application does not provide a user interface, this requirement is not applicable. Logon to the application as a test user and verify successful authentication by creating test data, navigating the application functionality or otherwise utilizing the application. Note the date and time access was granted. Log out of the application. Re-authenticate to the application as the same user. Validate the last logon date and time is displayed in the user interface. If the date and time the user account was last granted access to the application is not displayed in the user interface, this is a finding.

Fix text

Design and configure the application to display the date and time when the user was last successfully granted access to the application.

Pro Tips

Powered by sagemincer