SC.L2-3.13.9Connections Termination
Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
[a]
a period of inactivity to terminate network connections associated with communications sessions is defined;[b]
network connections associated with communications sessions are terminated at the end of the sessions; and[c]
network connections associated with communications sessions are terminated after the defined period of inactivity.
Inactivity windows defined per connection type: 15 minutes for admin sessions, 12 hours for VPN
Implementation
AO coverage. Addresses all three Connections Termination objectives: defining the inactivity period, terminating at end of session, and terminating after the defined inactivity period.
Defined periods [a]. The standard names a value per connection type rather than one global number, because a 15-minute VPN drop would be unusable and a 12-hour admin session would be unsafe. Administrative remote desktop and SSH sessions: 15 minutes idle. Standard user remote desktop: 30 minutes idle. VPN: 12 hours idle with a 24-hour absolute lifetime forcing re-authentication. Web application sessions for CUI apps: 30 minutes idle. Values are recorded in the configuration standard with the rationale, so the defined-versus-implemented comparison an assessor makes is a document-to-config check.
Termination at end of session [b]. Logoff tears down the session rather than leaving it disconnected: the remote desktop policy ends disconnected sessions instead of preserving them, so a closed window does not leave a live connection with a CUI application open behind it. VPN client disconnect and OS shutdown both trigger gateway-side teardown, and the gateway reaps sessions whose client heartbeat stops. Application sign-out invalidates the server-side session, not just the browser cookie.
Termination on inactivity [c]. Group policy applies the idle limits to the jump tier. SSH uses ClientAliveInterval with a low ClientAliveCountMax plus a shell TMOUT for interactive shells, which covers the case where the client is alive but the human is not. The firewall's own idle session TTL keeps half-open flows from lingering after a client disappears without a FIN.
Shift-work handling. Contractors on overlapping shifts previously shared long-lived sessions. Now each shift change requires a fresh authentication; the handoff procedure includes signing out, and a detection fires on a session whose duration exceeds the absolute lifetime.
Maintenance. Quarterly test per connection type: open a session, idle it past the limit, and confirm termination with a screenshot and log entry. Monthly report of sessions exceeding the absolute VPN lifetime. Re-validate after gateway or OS upgrades, which sometimes reset session defaults.
Accepted gap. A long-running simulation job on the build cluster cannot survive a 15-minute idle disconnect. Jobs run detached under a scheduler so the interactive session can terminate on schedule while the workload continues; interactive shells still time out, and no exception to the idle limit was granted.
What the evidence looks like
- Configuration standard listing the defined inactivity period per connection type
- Group policy export for remote desktop idle and disconnected-session limits
- VPN gateway idle and absolute lifetime settings
- sshd_config and shell profile showing keepalive and TMOUT values
- Quarterly idle-termination test evidence for each connection type
Environment
Tools
Was this example useful?
Quick reaction — no account needed. For reasoning that moves the community meter, cast a full verdict below.
Discussion(0)
No discussion on this example yet
Verdicts capture a conclusion. Use a thread when the interesting part is the argument.
Sign in to start a thread.