ComplianceNIST 800-53 control

NIST-AC-10 Concurrent Session Control

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
AC Access Control
Control
AC-10
ATT&CK techniques mitigated
4

Control statement

Limit the number of concurrent sessions for each [Assignment: account and/or account types] to [Assignment: number].

Discussion

Organizations may define the maximum number of concurrent sessions for system accounts globally, by account type, by account, or any combination thereof. For example, organizations may limit the number of concurrent sessions for system administrators or other individuals working in particularly sensitive domains or mission-critical applications. Concurrent session control addresses concurrent sessions for system accounts. It does not, however, address concurrent sessions by single users via multiple system accounts.

ATT&CK mappings (CTID)

• T1137 Office Application Startup • T1137.002 Office Test • T1185 Browser Session Hijacking • T1528 Steal Application Access Token

Related

Mitigates · MITRE ATT&CK (4)

  • T1137.002 Office Test sub-technique
  • T1528 Steal Application Access Token technique
  • T1185 Browser Session Hijacking technique
  • T1137 Office Application Startup technique

Related control · Compliance (1)

  • NIST-SC-23 Session Authenticity NIST 800-53 control

Referenced by Compliance · has member (1)

  • NIST-AC Access Control NIST 800-53 family

Referenced by Compliance · related control (1)

  • NIST-SC-23(3) Unique System-generated Session Identifiers NIST 800-53 enhancement