BSI certification requirement: Secure Session Management

As part of the “BSI IT Grundschutz” certification for watsonx on Software Hub, following product enhancement needs to be fulfilled in a future release. Feedback from Mehboob Alam was incorporated.

Building block CON 10 Development of Web Applications, CON.10.A3 Secure Session Management (B)

Description:

Developers MUST ensure that session IDs are protected appropriately. Session IDs MUST be generated randomly and with sufficient entropy. If the web application framework in use can generate secure session IDs, the Developers MUST use this feature. The security-relevant configuration options of the framework MUST be considered. If session IDs are transmitted and stored by the clients, they MUST be transmitted with sufficient protection. A web application MUST provide users with the option to expressly terminate an active session. After a user has logged in, any existing session ID MUST be replaced by a new one. Sessions MUST have a maximum validity period (timeout). Inactive sessions MUST automatically expire after a specified period of time. After a session has become invalid, all the session data MUST be rendered invalid and deleted.

Missing requirements:

1. SW Hub and products do not support the following: The goal is at least 64 bits of entropy. This can be achieved by using a cryptographically secure pseudorandom number generator (CSPRNG) to create long, unique session IDs. For example, a 128-bit session ID generated with a CSPRNG provides sufficient entropy to deter attackers.
2. Provide users/admins with the option to expressly terminate an active session.

https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.html