The application server must limit the number of failed login attempts to an organization defined number of consecutive invalid attempts that occur within an organization defined time period.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35766	SRG-APP-000065-AS-000032	SV-47053r1_rule		Medium

Description
Anytime an authentication method is exposed so as to allow for the login to an application, there is a risk that attempts will be made to obtain unauthorized access. By limiting the number of failed login attempts that occur within a particular time period, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account once the number of failed attempts has been exceeded.

Description

Anytime an authentication method is exposed so as to allow for the login to an application, there is a risk that attempts will be made to obtain unauthorized access. By limiting the number of failed login attempts that occur within a particular time period, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account once the number of failed attempts has been exceeded.

STIG	Date
Application Server Security Requirements Guide	2013-01-08

Details

Check Text ( C-44112r1_chk )
Review AS documentation and configuration to verify the AS limits the number of failed login attempts to a defined number within a defined time period (e.g., 5 failed attempts within 15 minutes). If the AS is not configured to meet this requirement, this is a finding.

Fix Text (F-40312r1_fix)
Configure the AS to limit the number of failed login attempts within the defined time period.