+AC-07 Unsuccessful Logon Attempts
---+AC-07(02) Purge or Wipe Mobile Device
---+AC-07(03) Biometric Attempt Limiting
---+AC-07(04) Use of Alternate Authentication Factor

AC-07 Unsuccessful Logon Attempts

Control

  1. Enforce a limit of [Assignement: number] consecutive invalid logon attempts by a user during a [Assignement: time period] ; and
  2. Automatically [Selection(one-or-more): lock the account or node for {{ insert: param, ac-07_odp.04 }} ; lock the account or node until released by an administrator; delay next logon prompt per {{ insert: param, ac-07_odp.05 }} ; notify system administrator; take other {{ insert: param, ac-07_odp.06 }} ] when the maximum number of unsuccessful attempts is exceeded.

Discussion

The need to limit unsuccessful logon attempts and take subsequent action when the maximum number of attempts is exceeded applies regardless of whether the logon occurs via a local or network connection. Due to the potential for denial of service, automatic lockouts initiated by systems are usually temporary and automatically release after a predetermined, organization-defined time period. If a delay algorithm is selected, organizations may employ different algorithms for different components of the system based on the capabilities of those components. Responses to unsuccessful logon attempts may be implemented at the operating system and the application levels. Organization-defined actions that may be taken when the number of allowed consecutive invalid logon attempts is exceeded include prompting the user to answer a secret question in addition to the username and password, invoking a lockdown mode with limited user capabilities (instead of full lockout), allowing users to only logon from specified Internet Protocol (IP) addresses, requiring a CAPTCHA to prevent automated attacks, or applying user profiles such as location, time of day, IP address, device, or Media Access Control (MAC) address. If automatic system lockout or execution of a delay algorithm is not implemented in support of the availability objective, organizations consider a combination of other actions to help prevent brute force attacks. In addition to the above, organizations can prompt users to respond to a secret question before the number of allowed unsuccessful logon attempts is exceeded. Automatically unlocking an account after a specified period of time is generally not permitted. However, exceptions may be required based on operational mission or need.

Assessment Objective

  1. a limit of [Assignement: number] consecutive invalid logon attempts by a user during [Assignement: time period] is enforced;
  2. automatically [Selection(one-or-more): lock the account or node for {{ insert: param, ac-07_odp.04 }} ; lock the account or node until released by an administrator; delay next logon prompt per {{ insert: param, ac-07_odp.05 }} ; notify system administrator; take other {{ insert: param, ac-07_odp.06 }} ] when the maximum number of unsuccessful attempts is exceeded.

Assessment Method

Examine

Access control policy procedures addressing unsuccessful logon attempts system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

Organizational personnel with information security responsibilities system developers system/network administrators

1. Oversigt

AC-07(02) Purge or Wipe Mobile Device

Control

Purge or wipe information from [Assignement: mobile devices] based on [Assignement: purging or wiping requirements and techniques] after [Assignement: number] consecutive, unsuccessful device logon attempts.

Discussion

A mobile device is a computing device that has a small form factor such that it can be carried by a single individual; is designed to operate without a physical connection; possesses local, non-removable or removable data storage; and includes a self-contained power source. Purging or wiping the device applies only to mobile devices for which the organization-defined number of unsuccessful logons occurs. The logon is to the mobile device, not to any one account on the device. Successful logons to accounts on mobile devices reset the unsuccessful logon count to zero. Purging or wiping may be unnecessary if the information on the device is protected with sufficiently strong encryption mechanisms.

Assessment Objective

information is purged or wiped from [Assignement: mobile devices] based on [Assignement: purging or wiping requirements and techniques] after [Assignement: number] consecutive, unsuccessful device logon attempts.

Assessment Method

Examine

Access control policy procedures addressing unsuccessful logon attempts on mobile devices system design documentation system configuration settings and associated documentation list of mobile devices to be purged/wiped after organization-defined consecutive, unsuccessful device logon attempts list of purging/wiping requirements or techniques for mobile devices system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities
AC-07(03) Biometric Attempt Limiting

Control

Limit the number of unsuccessful biometric logon attempts to [Assignement: number].

Discussion

Biometrics are probabilistic in nature. The ability to successfully authenticate can be impacted by many factors, including matching performance and presentation attack detection mechanisms. Organizations select the appropriate number of attempts for users based on organizationally-defined factors.

Assessment Objective

unsuccessful biometric logon attempts are limited to [Assignement: number].

Assessment Method

Examine

Access control policy procedures addressing unsuccessful logon attempts on biometric devices system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities
AC-07(04) Use of Alternate Authentication Factor

Control

  1. Allow the use of [Assignement: authentication factors] that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded; and
  2. Enforce a limit of [Assignement: number] consecutive invalid logon attempts through use of the alternative factors by a user during a [Assignement: time period].

Discussion

The use of alternate authentication factors supports the objective of availability and allows a user who has inadvertently been locked out to use additional authentication factors to bypass the lockout.

Assessment Objective

  1. [Assignement: authentication factors] that are different from the primary authentication factors are allowed to be used after the number of organization-defined consecutive invalid logon attempts have been exceeded;
  2. a limit of [Assignement: number] consecutive invalid logon attempts through the use of the alternative factors by the user during a [Assignement: time period] is enforced.

Assessment Method

Examine

Access control policy procedures addressing unsuccessful logon attempts for primary and alternate authentication factors system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by AC-07 Unsuccessful Logon Attempts – Assessment Procedure
is blocked by Account Lockout