Does SQL Server 2008 R2 recognize only system-generated session identifiers,

Question

As part of the locking down of our system we are doing the Security Technical Implementation Guide (STIG) and one of the questions it asks is "The DBMS must recognize only system-generated session identifiers."
I have looked at the STIG version for SQL Server 2012 and this is not a finding on it, since it supports the requirement and cannot be configured out of compliance.
If anyone can help confirm that this is also the case with SQL Server 2008 R2 that would be very helpful.
Thank you, Darren
The discussion of it is:
This requirement focuses on communications protection at the application session, versus network packet level. The intent of this control is to establish grounds for confidence at each end of a communications session in the ongoing identity of the other
party and in the validity of the information being transmitted.
Unique session IDs are the opposite of sequentially generated session IDs which can be easily guessed by an attacker. Unique session identifiers help to reduce predictability of said identifiers. 
Unique session IDs address man-in-the-middle attacks including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have
more difficulty in hijacking the session or otherwise manipulating valid sessions.
The DBMS must only recognize only system generated session identifiers. If an attacker was able to generate a session with a non-system generated session identifier and have it be recognized by the system, the attacker could potentially gain access to the
system without passing through access controls designed to limit database sessions to authorized users.

Answer 1

Hi Darren,
From your description, do you mean the session_id from DMV sys.dm_exec_sessions? If so, the session_id(s) are all created and handled by SQL Server. When session_id <= 50 , it belongs to a system session, and when session_id > 50, it belongs to a user
session.
Below query could help you generate system sessions in SQL Server 2008 R2. Refer to :
Explore the secrets of session- sys.dm_exec_sessions.
SELECT
S.SESSION_ID,
S.STATUS,
S.HOST_NAME,
C.CLIENT_NET_ADDRESS,
CASE WHEN S.LOGIN_NAME = S.ORIGINAL_LOGIN_NAME THEN S.LOGIN_NAME ELSE S.LOGIN_NAME + ' (' +S.ORIGINAL_LOGIN_NAME + ')' END AS LOGIN_NAME,
S.PROGRAM_NAME,
C.CONNECT_TIME, -- DIFFRENT BETWEEN CONNECT & LOGIN TIME IS TIME TAKEN BY PRELOGON ACTIVITIES
S.LOGIN_TIME,
CASE S.TRANSACTION_ISOLATION_LEVEL
WHEN 0 THEN 'UNSPECIFIED'
WHEN 1 THEN 'READUNCOMITTED'
WHEN 2 THEN 'READCOMMITTED'
WHEN 3 THEN 'REPEATABLE'
WHEN 4 THEN 'SERIALIZABLE'
WHEN 5 THEN 'SNAPSHOT'
ELSE CAST(S.TRANSACTION_ISOLATION_LEVEL AS VARCHAR(32))
END AS TRANSACTION_ISOLATION_LEVEL_NAME,S.LAST_SUCCESSFUL_LOGON, -- REQUIRES 'COMMON CRITERIA COMPLIANCE ENABLED' OPTION VIA SP_CONFIGURE.
S.LAST_UNSUCCESSFUL_LOGON, -- REQUIRES 'COMMON CRITERIA COMPLIANCE ENABLED' OPTION VIA SP_CONFIGURE.
S.UNSUCCESSFUL_LOGONS, --REQUIRES 'COMMON CRITERIA COMPLIANCE ENABLED' OPTION VIA SP_CONFIGURE.
S.CPU_TIME AS CPU_TIME_MS,
S.MEMORY_USAGE AS MEMORY_USAGE_PAGES,
S.ROW_COUNT,
S.PREV_ERROR,
S.LAST_REQUEST_START_TIME,
S.LAST_REQUEST_END_TIME,
C.NET_TRANSPORT,
C.PROTOCOL_TYPE,
S.LANGUAGE,
S.DATE_FORMAT,
ST.TEXT AS QUERY_TEXT
FROM
SYS.DM_EXEC_SESSIONS S
FULL OUTER JOIN SYS.DM_EXEC_CONNECTIONS C ON C.SESSION_ID = S.SESSION_ID
CROSS APPLY SYS.DM_EXEC_SQL_TEXT(C.MOST_RECENT_SQL_HANDLE) ST
WHERE
S.SESSION_ID IS NULL
OR S.SESSION_ID < = 50
ORDER BY
S.SESSION_ID
Thanks,
Lydia Zhang