Title

AAA Services must be configured to automatically lock user accounts after three consecutive invalid logon attempts within a 15-minute time period. (Cat II impact)

Discussion

By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.

Check Content

If AAA Services rely on directory services for user account management, this is not applicable and the connected directory services must perform this function. Verify AAA Services are configured to automatically lock user accounts after three consecutive invalid logon attempts within a 15-minute time period. If AAA Services are not configured to automatically lock user accounts after three consecutive invalid logon attempts within a 15-minute time period, this is a finding.

Fix Text

Configure AAA Services to automatically lock user accounts after three consecutive invalid logon attempts within a 15-minute time period.

Additional Identifiers

Rule ID: SV-95561r1_rule

Vulnerability ID: V-80851

Group Title: SRG-APP-000065-AAA-000200

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.