The MDM server must enforce the organization defined time period during which the limit of consecutive invalid access attempts by an administrator is counted.

The MDM server must enforce the organization defined time period during which the limit of consecutive invalid access attempts by an administrator is counted.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-36074	SRG-APP-066-MDM-074-SRV	SV-47465r1_rule		Medium

Description
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.

STIG	Date
Mobile Device Manager Security Requirements Guide	2013-01-24

Details

Check Text ( C-44313r1_chk )
Review the MDM server configuration to ensure the organization defined time period during which the limit of consecutive invalid access attempts by an administrator is counted. If no time limit is set or is set to a value different than the organizations policy, this is a finding.

Fix Text (F-40604r1_fix)
Configure the MDM server to enforce the organization defined time period during which the limit of consecutive invalid access attempts by an administrator is counted.