Title

Timer job retries for automatic password change on Managed Accounts must meet DoD password retry policy. (Cat II impact)

Discussion

When an authentication method is exposed to allow for the utilization of an application, there is a risk that attempts will be made to obtain unauthorized access. To defeat these attempts, organizations define the number of times a user account may consecutively fail a log in attempt. The organization also defines the period of time in which these consecutive failed attempts may occur. By limiting the number of failed log in attempts, the risk of unauthorized system access via user password guessing otherwise known as brute forcing is reduced. Limits are imposed by locking the account. The automatic password change feature for Managed Accounts allows SharePoint to automatically generate new strong passwords on a schedule set by the administrator. This generates a password change job in the Timer Service. Limiting the number of times the job attempts to change the password, will help guard against a password change attack.

Check Content

1. In SharePoint Central Administration, click Security. 2. On the Security page, in the General Security list, click Configure password change settings. 3. On the Password Management Settings page, in the Automatic Password Change Settings section, verify “Number of retries before password change timer fails:” is set to 3. (Numbers less than 3 are not normally recommended.) 4. Mark as a finding if the “Number of retries before password change timer fails:” is set to a number greater than 3.

Fix Text

1. In SharePoint Central Administration, click Security. 2. On the Security page, in the General Security list, click Configure password change settings. 3. On the Password Management Settings page, in the Automatic Password Change Settings section, set the “Number of retries before password change timer fails:” to 3.

Additional Identifiers

Rule ID: SV-37975r2_rule

Vulnerability ID: V-28249

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.