UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The application must enforce the limit of three consecutive invalid logon attempts by a user during a 15 minute time period.


Overview

Finding ID Version Rule ID IA Controls Severity
V-69343 APSC-DV-000530 SV-83965r1_rule High
Description
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account. User notification when three failed logon attempts are exceeded is an operational consideration determined by the application owner. In some instances the operational situation may dictate that no notice is to be provided to the user when their account is locked. In other situations, the user may be notified their account is now locked. This decision is left to the application owner based upon their operational scenarios.
STIG Date
Application Security and Development Security Technical Implementation Guide 2017-03-20

Details

Check Text ( C-69755r1_chk )
All testing must be performed within a 15-minute window.

Log on to the application with a test user account.

Intentionally enter an incorrect user password or pin.

Repeat 2 times within 15 minutes for a total of three failed attempts.

Notification of a locked account may or may not be provided.

Using the correct user password or pin, attempt to logon a 4th time.

If the logon is successful upon the 4th attempt the account was not locked after the third failed attempt and this is a finding.
Fix Text (F-75517r1_fix)
Configure the application to enforce an account lock after 3 failed logon attempts occurring within a 15-minute window.