The Palo Alto Networks security platform must enforce the limit of three consecutive invalid logon attempts.
An XCCDF Rule
Description
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced.
- ID
- SV-228639r960840_rule
- Version
- PANW-NM-000015
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
This should not be configured in Device >> Setup >> Management >> Authentication Settings; instead, an authentication profile should be configured with lockout settings of three failed attempts and a lockout time of zero minutes.
Go to Device >> Authentication Profile
Select the configured authentication profile or select "Add" (in the bottom-left corner of the pane) to create a new one.
In the "Authentication Profile" field, enter the name of the authentication profile that will be used to control each person's authentication process.
The "Lockout Time (min)" field is the lockout duration; this must be set to "0". This will keep the lockout in effect until it is manually unlocked.
In the "Failed Attempts" field, enter "3".