Re: Account Lockout Policies

[Graham Toal <gtoal () UTPA EDU>]

> In addition to complexity requirements, 
> their Best Practices recommendations include password 
> policies set as follows:
>  
> - Account Lockout Threshold: 3 Attempts
> - Account Lockout Duration: Administrator Unlocks
>  
> We have two separate problems with this recommendation.

> We would like to conform to the recommendations our auditors 
> have made, but are having difficulty with this one.  Any 
> suggestions or insights on your experiences with Account 
> Lockouts and/or utilities that manage this would be greatly 
> appreciated.

Do you have the option of making the lockout apply only to the
IP address that the attempt came from?  Then you wouldn't (so
easily) be likely to cause a denial of service.

The 'administrator unlocks' is something you need to persuade
your auditor may not be workable.  (Something he'll probably
be convinced of pretty quickly should someone malicious lock
out the auditor repeatedly...)

IMHO even a 5 minute auto-reenable should be enough to undo
a password-guessing attack.


Graham