Title

The organization must define the maximum number of consecutive, unsuccessful login attempts to CMDs are permitted. (Cat II impact)

Discussion

Without proper lockout policies that define the maximum number of consecutive unsuccessful login attempts, unauthorized users could continually attempt to gain access to the mobile device. Allowing an unlimited number of login attempts to a mobile device could result in unauthorized access to data that is stored on the mobile device (e.g., contact lists, emails, calendar events, etc.) and unauthorized use of the mobile device.

Check Content

Review the organization's access control policy and security procedures for mobile devices to determine if the organization has properly and clearly defined the maximum number of consecutive unsuccessful login attempts to the mobile device. If the security procedures or access control policy does not define the maximum number of consecutive unsuccessful login attempts, this is a finding.

Fix Text

Clearly define the maximum number of consecutive unsuccessful login attempts to the mobile device in its access control policy and/or security procedures.

Additional Identifiers

Rule ID:

Vulnerability ID: V-35910

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.