Detections
Analytics

3.1 Ensure 'FAILED_LOGIN_ATTEMPTS' Is Less than or Equal to '5'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The FAILED_LOGIN_ATTEMPTS setting determines how many failed login attempts are permitted before the system locks the user's account. While different profiles can have different and more restrictive settings, such as USERS and APPS, the minimum(s) recommended here should be set on the DEFAULT profile.

Rationale:

Repeated failed login attempts can indicate the initiation of a brute-force login attack, this value should be set according to the needs of the organization. (See the Notes for a warning on a known bug that can make this security measure backfire.)

Solution

Remediate this setting by executing the following SQL statement for each PROFILE returned by the audit procedure.

ALTER PROFILE <profile_name> LIMIT FAILED_LOGIN_ATTEMPTS 5;

See Also

https://workbench.cisecurity.org/files/2868

Item Details

References: CSCv6|16.7, CSCv7|16.7

Plugin: OracleDB

Control ID: 79c42b26ef0251612aeab8fdd39ef8418a00158c73e20764938f7952b5b14e43