Title

The network devices must time out access to the console port at 10 minutes or less of inactivity. (Cat II impact)

Discussion

Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network device. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.

Check Content

Review the configuration and verify a session using the console port will time out after 10 minutes or less of inactivity. If console access is not configured to timeout at 10 minutes or less, this is a finding.

Fix Text

Configure the timeout for idle console connection to 10 minutes or less.

Additional Identifiers

Rule ID: SV-3967r4_rule

Vulnerability ID: V-3967

Group Title: The console port does not timeout after 10 minutes.

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.