The organization must define the maximum number of consecutive, unsuccessful login attempts to the mobile devices permitted.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-MPOL-001	SRG-MPOL-001	SRG-MPOL-001_rule		Medium

Description
Without proper lockout policies that define the maximum number of consecutive unsuccessful login attempts, unauthorized users could continually attempt to gain access to the mobile device. Allowing an unlimited number of login attempts to a mobile device could result in unauthorized access to data that is stored on the mobile device (e.g., contact lists, emails, calendar events, etc.) and unauthorized use of the mobile device.

Description

Without proper lockout policies that define the maximum number of consecutive unsuccessful login attempts, unauthorized users could continually attempt to gain access to the mobile device. Allowing an unlimited number of login attempts to a mobile device could result in unauthorized access to data that is stored on the mobile device (e.g., contact lists, emails, calendar events, etc.) and unauthorized use of the mobile device.

STIG	Date
Mobile Policy Security Requirements Guide	2012-10-10

Details

Check Text ( C-SRG-MPOL-001_chk )
Review the organization's access control policy and security procedures for mobile devices to determine if the organization has properly and clearly defined the maximum number of consecutive unsuccessful login attempts to the mobile device. If the security procedures or access control policy does not define the maximum number of consecutive unsuccessful login attempts, this is a finding.

Fix Text (F-SRG-MPOL-001_fix)
Clearly define the maximum number of consecutive unsuccessful login attempts to the mobile device in its access control policy and/or security procedures.