CMMC Practice AC.L2-3.1.8 – Unsuccessful Logon Attempts: Limit unsuccessful logon attempts.
Links to Publicly Available Resources
This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 2. Protecting users and applications from brute force login attacks through strong password policies. This article describes mechanisms to limit unsuccessful logon attempts. This article describes how to set an account lockout policy. Best practices for implementing account lockout policies, and an overview of Active Directory account lockout policy. How to reduce the risk of a password dictionary attack through an account lockout policy. Let’s talk about NIST 800-171 Control 3.1.8 - Limit unsuccessful logon attempts.
Discussion [NIST SP 800-171 R2]
This requirement applies regardless of whether the logon occurs via a local or network connection. Due to the potential for denial of service, automatic lockouts initiated by systems are, in most cases, temporary and automatically release after a predetermined period established by the organization (i.e., a delay algorithm). If a delay algorithm is selected, organizations may employ different algorithms for different system components based on the capabilities of the respective components. Responses to unsuccessful logon attempts may be implemented at the operating system and application levels.
Further Discussion
Consecutive unsuccessful logon attempts may indicate malicious activity. Contractors can mitigate these attacks by limiting the number of unsuccessful logon attempts, typically by locking the account. A defined number of consecutive unsuccessful logon attempts is a common configuration setting. Contractors are expected to set this number at a level that fits their risk profile with the knowledge that fewer unsuccessful attempts provide higher security.
After an unsuccessful login attempt threshold is exceeded and the system locks an account, the account may either remain locked until an administrator takes action to unlock it, or it may be locked for a predefined time after which it unlocks automatically.