03.01.08 Unsuccessful Logon Attempts

This policy establishes procedures to mitigate the risk of unauthorized access to systems and data by limiting the number of consecutive unsuccessful logon attempts by any user. This control aims to deter brute-force attacks and other automated methods of gaining unauthorized access.

• A.03.01.08.ODP[01]: the number of consecutive invalid logon attempts by a user allowed during a time period is defined.
• A.03.01.08.ODP[02]: the time period to which the number of consecutive invalid logon attempts by a user is limited is defined.
• A.03.01.08.ODP[03]: one or more of the following PARAMETER VALUES are selected: {the account or node is locked automatically for ; the account or node is locked automatically until released by an administrator; the next logon prompt is delayed automatically; the system administrator is notified automatically; other action is taken automatically}.
• A.03.01.08.ODP[04]: the time period for an account or node to be locked is defined (if selected).
• A.03.01.08.a: a limit of consecutive invalid logon attempts by a user during is enforced.
• A.03.01.08.b: when the maximum number of unsuccessful attempts is exceeded.