The Application Server must automatically lock accounts when the maximum number of unsuccessful login attempts is exceeded for an organization defined time period or until the account is unlocked by an administrator.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35770	SRG-APP-000067-AS-000034	SV-47057r1_rule		Medium

Description
Anytime an authentication method is exposed so as to allow for the utilization of an application interface, there is a risk that attempts will be made to obtain unauthorized access. By locking the account when the pre-defined number of failed login attempts has been exceeded, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Specifying a time period in which the account is to remain locked serves to obstruct the operation of automated password guessing tools while allowing a valid user to reinitiate login attempts after the expiration of the time period without administrative assistance.

Description

Anytime an authentication method is exposed so as to allow for the utilization of an application interface, there is a risk that attempts will be made to obtain unauthorized access. By locking the account when the pre-defined number of failed login attempts has been exceeded, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Specifying a time period in which the account is to remain locked serves to obstruct the operation of automated password guessing tools while allowing a valid user to reinitiate login attempts after the expiration of the time period without administrative assistance.

STIG	Date
Application Server Security Requirements Guide	2013-01-08

Details

Check Text ( C-44115r1_chk )
Review AS documentation and configuration to verify the AS can be configured to lock accounts when the maximum number of failed login attempts has been exceeded. Also verify that the account remains locked for a configurable amount of time or until an administrator unlocks the account. If the AS is not configured to meet this requirement, this is a finding.

Fix Text (F-40316r2_fix)
Configure the AS to lock the account when the maximum number of failed login attempts is exceeded and configure the time period for which the account is to remain locked.