Title

The Riverbed NetIM must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes. (Cat II impact)

Discussion

By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced.

Check Content

Verify Password Rules are configured for "Maximum failed login attempts allowed". 1. From the GUI, navigate to Configuration >> Configure >> All Settings >> Administer. 2. On the User Management screen, select "Password Rules". 3. Verify "Maximum failed login attempts allowed" is checked and set to "3". 4. Verify "Time interval for max failed login attempts in minutes" is set to "15". If both "Maximum failed login attempts allowed" is not set to "3" and the "Time interval for max failed login attempts in minutes" is set to "15", this is a finding.

Fix Text

Configure the Password Rules for Maximum failed login attempts allowed. 1. From the GUI, navigate to Configuration >> Configure >> All Settings >> Administer. 2. On the User Management screen, select "Password Rules". 3. Check the box for "Maximum failed login attempts allowed". 4. Enter "3" in the option box. 5. Check the box for "Time interval for max failed login attempts in minutes". 6. Enter "15" in the option box and click "Submit". Note: Local users must not be created; however, setting these requirements are a good best practice.

Additional Identifiers

Rule ID: SV-275481r1148299_rule

Vulnerability ID: V-275481

Group Title: SRG-APP-000065-NDM-000214

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.