Device binding and session limits

Control Design Assessment (CDA)

Procedures evaluating whether the control is designed adequately.

1. 1.Inspect the mobile session configuration to confirm sessions are bound to a registered device identifier.
2. 2.Confirm a session timeout is enforced and cannot be extended indefinitely by user activity alone.

Control Operating Effectiveness (COE)

Procedures evaluating whether the control operated over the testing period.

1. 1.Attempt to replay a session token on an unregistered device and confirm access is denied.
2. 2.Select 25 mobile sessions from the period and confirm each enforced the configured timeout.
3. 3.Review configuration change logs to confirm device binding was not disabled during the period.

Linked risks

• Mobile channel account takeovermitigation 3

Framework mappings & latest test