46
Cybersecurity Guidelines for Digital Financial Asset Trading Providers in Indonesia
technical controls is necessary, by considering the following aspects: a. Auto-Session Timeout Organizations must implement an auto-session timeout mechanism that automatically disconnects or ends a user session after a specific period of inactivity (e.g., 15–30 minutes for critical systems). The goal is to prevent unauthorized parties from accessing the system via unattended devices left in a logged- in state. Timeout durations should also be adjusted based on the sensitivity of the accessed data and the associated operational risk. b. Session Token Security and Management Session tokens (e.g., Java Web Token (JWT), OAuth tokens) used to authenticate user sessions must be: 1 Securely stored (e.g., in HTTP-only secure cookies for web applications). 2 Configured with token expiration times that are reasonable and proportionate to their risk level. 3 Automatically revoked when users log out of the system, or when credential changes occur, such as password updates, token rotation, or anomaly detection in the session. To prevent the misuse of stolen tokens, the system must also be capable of detecting and forcibly terminating active sessions if suspicious activity is identified or if there are reports of a compromised account.
Made with FlippingBook Ebook Creator