Re: Account Lockout Policies

[Gary Dobbins <dobbins () ND EDU>]

Instead of hard lockout, consider having the authentication service
merely add an increasing delay to successive negative responses (and no
delay to the final positive response).

This slows brute-force guessers to a crawl, while not seriously
impacting the legitimate user who simply needs one-more-chance to
remember their new password.




Saburo Usami wrote:
> Sacred Heart University is configuring its Windows 2003 systems to
> conform with Best Practices as recommended by an external auditor.  In
> addition to complexity requirements, their Best Practices
> recommendations include password policies set as follows:
>
> - Account Lockout Threshold: 3 Attempts
> - Account Lockout Duration: Administrator Unlocks
>
> We have two separate problems with this recommendation.
>
> 1. From an administrative standpoint, we feel that these settings may
> actually encourage users (e.g., disgruntled students just prior to
> mid-terms/finals) to cause trouble for others on the network by
> deliberately shutting their fellow students or instructors out of the
> network -- or running scripts to do the same -- and "security by
> obscurity" seems like a losing bet in the academic network space.
>
> 2. From a technical standpoint, Windows 2003 does not allow a
> "perpetual" lockout stance.  99,999 is the maximum number of minutes an
> account can be locked out
> <http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/bpactlck.mspx>.
> This translates to about 69.44 days, which is less than a semester and
> less than a summer break.  Hence, we can't truly comply with the
> recommended lockout duration.
>
> We would like to conform to the recommendations our auditors have made,
> but are having difficulty with this one.  Any suggestions or insights on
> your experiences with Account Lockouts and/or utilities that manage this
> would be greatly appreciated.
>
> Saburo Usami
> Director of Networking - Telecomm - IT Security
> Sacred Heart University

--

  ------------------------------------------------------------
  Gary Dobbins, CISSP -- Director, Information Security
  University of Notre Dame, Office of Information Technologies