The firewall implementation must automatically lock an account after the maximum number of unsuccessful login attempts are exceeded and remain locked for an organizationally defined time period or until released by an administrator.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000040-FW-000035	SRG-NET-000040-FW-000035	SRG-NET-000040-FW-000035_rule		Medium

Description
The firewall implementation must automatically lock the account for an organizationally defined time period or until released by an administrator according to organizational policy. Locking an account after a maximum number of unsuccessful login attempts are exceeded will reduce the risk of unauthorized system access via password guessing. When the maximum number of unsuccessful login attempts is exceeded the possible actions are as follows. (i) Lock the account for an organizationally defined time period then automatically unlock the account; (ii) Require the account be unlocked by manual administrator action; or (iii) Delay the next login prompt using an organizationally defined delay algorithm.

Description

The firewall implementation must automatically lock the account for an organizationally defined time period or until released by an administrator according to organizational policy. Locking an account after a maximum number of unsuccessful login attempts are exceeded will reduce the risk of unauthorized system access via password guessing. When the maximum number of unsuccessful login attempts is exceeded the possible actions are as follows. (i) Lock the account for an organizationally defined time period then automatically unlock the account; (ii) Require the account be unlocked by manual administrator action; or (iii) Delay the next login prompt using an organizationally defined delay algorithm.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000040-FW-000035_chk )
Verify the setting for account lockout time release is set so the lockout remains in place for an organizationally defined time period or until a system administrator takes action to unlock the account. If the account lockout time is not set to release after an organizationally defined time period or when an administrator takes action to unlock the account, this is a finding.

Fix Text (F-SRG-NET-000040-FW-000035_fix)
Configure the lockout time setting for accounts used for accessing the firewall. Configure the account lockout to release only when an administrator takes action to unlock the account or after an organizationally defined time period.