Session Hijacking
What is Session Hijacking?
An attack in which an attacker takes over a valid user's web session by stealing or predicting the session token. Session hijacking gives the attacker the same privileges as the legitimate user.
Frameworks that govern session hijacking
What the standards actually require on session hijacking
Requirements naming session hijacking across 5 standards, quoted from the control text.
Encrypted sessions shall be used, against session hijacking and man-in-the-middle.
iso-iec-29115-2013-entity-authentication-assurance-framework::10.3.C16 · Authentication control #16: EncryptedSession →The base PP defines the TOE's assets and TSF data together with its users, objects, subjects and security attributes and counters six threats (unauthorised access to TOE data and functions, session hijacking or piggybacking, eavesdropping on QKD link data, man...
etsi-industry-specification-group-isg-on-quantum-key-distribution-qkd::016.SPD · 016.SPD Security problem definition: threats, policies and assumptions →Operate cross-cutting requirements per NIST SP 800-63-3 / 63A / 63B / 63C. Threat Model per AAL: (a) per Section 8 of SP 800-63B + Section 4.4 of SP 800-63-3 (cover impersonation + verifier compromise + session hijacking + replay + phishing + denial of service...
NISTSP63-8 · Threat Model, Lifecycle Management, Privacy, Equity, Records, and Subscriber Communication →The other end is authenticated before exchanging information outside the security domain, active attacks (alteration, injection, session hijacking) are prevented and trigger incident procedures, and legally recognised authentication is accepted;
spain-ens::mp.com.3 · Integrity and authenticity of communications →The vehicle verifies the authenticity and integrity of messages it receives (Table B1: 4.1 spoofing by impersonation, 5.1 code injection, 6.1 information from untrusted sources, 6.2 man in the middle or session hijacking, 6.3 replay, 11.2 malicious V2X message...
unece-wp-29-r155::A5-M10 · Annex 5 M10 The vehicle verifies the authenticity and integrity of messages it receives →Questions people ask about session hijacking
What is Session Hijacking?
Why is Session Hijacking important for compliance?
Which compliance frameworks address Session Hijacking?
Where can I learn more about Session Hijacking?
See how Session Hijacking applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.