How does SessionLinker Works

Products

• SITEMINDER

Issue/Introduction

SessionLinker can protect session identifiers for multiple applications. How does SessionLinker Work ?

Environment

Component: Policy Server 
Environment: 12.8.x

 

Resolution

How SiteMinder Sessionlinker works.
===================================

Every time a user accesses a website or application via an HTTP connection, the Siteminder Product if installed/configured and enabled authenticates the user (for example, via a username and password) before opening the line of communication and providing access.

Session hijacking starts when an attacker gains unauthorized access to a user’s SMsession ID. Attackers typically gain this access by either stealing a user’s SMsession cookie.

The Enhanced Session Assurance feature prevents session hijacking and replay. When you log in, a DeviceDNA™ verification is performed to fingerprint the end-user device. The device is fingerprinted every five minutes by default.

####

Attackers will try a different way to exploit online security (Session hijacking is a common attack).

While CA / Broadcom Siteminder products can defeat session hijacking, sites(webSites) may still be vulnerable.

-Attackers will look to hijack for application-specific reasons.
-Most online applications use a separate session token even if they are secured with a WAM solution.
-An Attacker can login using their own credentials, then steal the application session from another user.
-In most cases, the application will then show the data from the stolen session.

#####

The SiteMinder session linker can detect and stop session hijacking attacks from the application's session.

SessionLinker links the application's session to the SiteMinder session that is not susceptible to session hijacking.

Can be a user with or without the Enhanced Session Assurance with DeviceDNA™ Feature.

Can be done without any modification or recording to the application.

Part of the Siteminder Secure proxy.

#####