The operating system, when the maximum number of unsuccessful attempts is exceeded, must automatically lock the account for an organization defined time period or must lock the account until released by an administrator IAW organizational policy.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-32933 | SRG-OS-000022-NA | SV-43331r1_rule | Medium |
| Description |
|---|
| Anytime an authentication method is exposed to allow for the utilization of an operating system, there is a risk that attempts will be made to obtain unauthorized access. Rationale for non-applicability: This vulnerability is better addressed by CCI-001383, which requires purging information from the device after multiple unsuccessful unlock attempts to the mobile device. |
| STIG | Date |
|---|---|
| Mobile Operating System Security Requirements Guide | 2013-07-03 |
Details
| Check Text ( C-41239r1_chk ) |
|---|
| This requirement is NA for the Mobile OS SRG. |
| Fix Text (F-36849r1_fix) |
|---|
| The requirement is NA. No fix is required. |