Title

The application must display the time and date of the users last successful logon. (Cat III impact)

Discussion

Providing a last successful logon date and time stamp notification to the user when they authenticate and access the application allows the user to determine if their application account has been used without their knowledge. Armed with that information, the user can notify the application administrator and initiate a forensics investigation to identify root cause. Without providing this information to the user, a potential compromise of user accounts could go unnoticed.

Check Content

Review the application documentation and interview the application administrator. If the application does not provide a user interface, this requirement is not applicable. Logon to the application as a test user and verify successful authentication by creating test data, navigating the application functionality or otherwise utilizing the application. Note the date and time access was granted. Log out of the application. Re-authenticate to the application as the same user. Validate the last logon date and time is displayed in the user interface. If the date and time the user account was last granted access to the application is not displayed in the user interface, this is a finding.

Fix Text

Design and configure the application to display the date and time when the user was last successfully granted access to the application.

Additional Identifiers

Rule ID: SV-222437r879551_rule

Vulnerability ID: V-222437

Group Title: SRG-APP-000075

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.