The network device must automatically lock an account after the maximum number of unsuccessful login attempts are exceeded and remain locked for an organizationally defined time period or until released by an administrator.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000040-NDM-000027	SRG-NET-000040-NDM-000027	SRG-NET-000040-NDM-000027_rule		Medium

Description
The network device must automatically lock the account for an organizationally defined time period or until released by an administrator according to organizational policy. Locking an account after a maximum number of unsuccessful login attempts are exceeded will reduce the risk of unauthorized system access via password guessing. When the maximum number of unsuccessful login attempts is exceeded the possible actions are as follows. (i) Lock the account for an organizationally defined time period then automatically unlock the account; (ii) Require the account be unlocked by manual administrator action; or (iii) Delay the next login prompt using an organizationally defined delay algorithm.

Description

The network device must automatically lock the account for an organizationally defined time period or until released by an administrator according to organizational policy. Locking an account after a maximum number of unsuccessful login attempts are exceeded will reduce the risk of unauthorized system access via password guessing. When the maximum number of unsuccessful login attempts is exceeded the possible actions are as follows. (i) Lock the account for an organizationally defined time period then automatically unlock the account; (ii) Require the account be unlocked by manual administrator action; or (iii) Delay the next login prompt using an organizationally defined delay algorithm.

STIG	Date
Network Device Management Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000040-NDM-000027_chk )
Verify the setting for account lockout time release is set so the lockout remains in place for an organizationally defined time period or until a system administrator takes action to unlock the account. If the account lockout is not configured to release only when an administrator takes action to unlock the account or automatically after an organizationally defined time period, this is a finding.

Check Text ( C-SRG-NET-000040-NDM-000027_chk )

Verify the setting for account lockout time release is set so the lockout remains in place for an organizationally defined time period or until a system administrator takes action to unlock the account.

If the account lockout is not configured to release only when an administrator takes action to unlock the account or automatically after an organizationally defined time period, this is a finding.

Fix Text (F-SRG-NET-000040-NDM-000027_fix)
Configure the lockout time setting for accounts used for accessing the network device. Configure the account lockout to release only when an administrator takes action to unlock the account or after an organizationally defined time period.