Account Lockout
What is Account Lockout?
A security feature that temporarily disables a user account after a specified number of failed authentication attempts to prevent brute force attacks.
Terms that appear alongside account lockout
Each of these is named in at least one of the same controls as account lockout. The number is how many controls name both.
- authentication 6 shared controls
- credential stuffing 4 shared controls
- owasp 3 shared controls
- multi factor authentication 3 shared controls
- nist 3 shared controls
- oauth 2 shared controls
- audit 2 shared controls
- access control 2 shared controls
Frameworks that govern account lockout
What the standards actually require on account lockout
Requirements naming account lockout across 6 standards, quoted from the control text.
Cap the number of consecutive failed logon attempts allowed and take a defined action, such as account lockout, once that limit is reached.
AC.L2-3.1.8 · Unsuccessful Logon Attempts →RP ID + origin binding define the SCOPE of a credential. RP ID: an effective domain (e.g. example.com) - a credential created with rpId=example.com works for example.com + www.example.com + login.example.com but NOT for evil.com NOR sub.different.com.
FIDO2-RP-Identity · Relying Party Identifier, Origin Binding, Cross-Origin and Conditional UI →Section 5.1 establishes electronic access account management capabilities required of IEDs. Per public IEEE 1686 + IEEE Std abstract + vendor capability statements (full IEEE text NOT reproduced): individual user accounts with unique identification (5.1) + no...
IEEE1686-Section5.1-AccessControl-Accounts-Roles-Password-Session-Remote · IEEE 1686 Section 5.1 - Electronic Access Account Management + Roles + Password + Failed Login + Session + Remote Access + Personnel →Implement system security management per CIP-007-6 including: ports and services management + security patch management (35-day evaluation + plan for mitigating actions) + malicious code prevention + security event monitoring + system access control (shared ac...
NERCCIP-5 · System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010) →Address API2:2023 Broken Authentication + token management per OWASP API Security Top 10 2023. Broken Authentication occurs when authentication mechanisms are weak + improperly implemented + or bypassable.
OWASPAPI-2 · Broken Authentication and Token Management →Per OWASP ASVS V2 + V2.4: implement strong authentication + credential storage. Requirements include (a) implement password strength requirements aligned with NIST SP 800-63B + reject compromised passwords against published breach lists + (b) implement secure...
OWASPASVS-2 · Authentication and Credential Storage (V2 + V2.4) →Questions people ask about account lockout
What is Account Lockout?
Why is Account Lockout important for compliance?
Which compliance frameworks address Account Lockout?
Where can I learn more about Account Lockout?
See how Account Lockout applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.