UCF STIG Viewer Logo

The organization must define the maximum number of consecutive, unsuccessful login attempts to CMDs are permitted.


Overview

Finding ID Version Rule ID IA Controls Severity
V-35910 SRG-MPOL-001 SV-47226r1_rule Medium
Description
Without proper lockout policies that define the maximum number of consecutive unsuccessful login attempts, unauthorized users could continually attempt to gain access to the mobile device. Allowing an unlimited number of login attempts to a mobile device could result in unauthorized access to data that is stored on the mobile device (e.g., contact lists, emails, calendar events, etc.) and unauthorized use of the mobile device.
STIG Date
Mobile Policy Security Requirements Guide 2013-07-03

Details

Check Text ( C-44154r1_chk )
Review the organization's access control policy and security procedures for mobile devices to determine if the organization has properly and clearly defined the maximum number of consecutive unsuccessful login attempts to the mobile device. If the security procedures or access control policy does not define the maximum number of consecutive unsuccessful login attempts, this is a finding.
Fix Text (F-40441r1_fix)
Clearly define the maximum number of consecutive unsuccessful login attempts to the mobile device in its access control policy and/or security procedures.