The organization must define the maximum number of consecutive, unsuccessful login attempts to CMDs are permitted.

From Mobile Policy Security Requirements Guide

Associated with: CCI-001382

SV-47226r1_rule The organization must define the maximum number of consecutive, unsuccessful login attempts to CMDs are permitted.

Vulnerability discussion

Without proper lockout policies that define the maximum number of consecutive unsuccessful login attempts, unauthorized users could continually attempt to gain access to the mobile device. Allowing an unlimited number of login attempts to a mobile device could result in unauthorized access to data that is stored on the mobile device (e.g., contact lists, emails, calendar events, etc.) and unauthorized use of the mobile device.

Check content

Review the organization's access control policy and security procedures for mobile devices to determine if the organization has properly and clearly defined the maximum number of consecutive unsuccessful login attempts to the mobile device. If the security procedures or access control policy does not define the maximum number of consecutive unsuccessful login attempts, this is a finding.

Fix text

Clearly define the maximum number of consecutive unsuccessful login attempts to the mobile device in its access control policy and/or security procedures.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.