Re: Measures of detecting breached email accounts

[Valdis Kletnieks <valdis.kletnieks () VT EDU>]

On Thu, 07 Dec 2017 00:09:46 -0800, Joseph Tam said:
> I've seen both diffuse and intensive failed logins -- neither are
> worth looking at from a security standpoint.  It's not uncommon for
> me to see thousands of guesses against one account, especially against
> administrative accounts.

Are you employing any sort of rate limiting or temp lockout/block when these
thousands are flooding in from off campus?

> What are the *exceptional* circumstances that would allow you differentiate
> any particular failed authentication versus the thousands of other attempts?

A long string of failures, followed by a success, if the source is off campus.

Especially if it's an admin or other sensitive account.

Attachment: _bin
Description: