Overview:
Limit unsuccessful logon attempts.
Action Items:
3.1.8[a]
Determine if: the means of limiting unsuccessful logon attempts is defined.
3.1.8[b]
Determine if: the defined means of limiting unsuccessful logon attempts is implemented.
POTENTIAL ASSESSMENT METHODS AND OBJECTS
1
Examine: Access control policy; procedures addressing unsuccessful logon attempts; system security plan; system design documentation; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records].
2
Interview: Personnel with information security responsibilities; system developers; system or network administrators].
3
Test: Mechanisms implementing access control policy for unsuccessful logon attempts].
Related Documents (document name and content will vary by organization):
1) Access control policy
2) procedures addressing unsuccessful logon attempts
3) system security plan
4) system design documentation
5) system configuration settings and associated documentation
6) system audit logs and records
7) other relevant documents or records
Additional Guidance:
This requirement applies regardless of whether the logon occurs via a local or network connection. Due to the potential for denial of service, automatic lockouts initiated by systems are, in most cases, temporary and automatically release after a predetermined period established by the organization. If a delay algorithm is selected, organizations may employ different algorithms for different system components based on the capabilities of the respective components. Responses to unsuccessful logon attempts may be implemented at the operating system and the application levels.
Article ID: 113
Created: September 26, 2022
Last Updated: September 27, 2022
Author: Matthew Burdick
Online URL: http://www.compliancewiki.org/article/nist-800-171-unsuccessful-logon-attempts-3-1-8-113.html