SPLK-CL-000240 - Splunk Enterprise must enforce the limit of 3 consecutive invalid logon attempts by a user during a 15 minute time period.

Information

By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.

In most enterprise environments, this requirement is usually mitigated by a properly configured external authentication system, like LDAP. Splunk local authentication takes precedence over other forms of authentication, and cannot be disabled. The mitigation settings in this requirement apply in the event a local account gets created, for example, an emergency account of last resort for recovery.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Select Settings >> Access Controls >> Password Policy Management.

Set Lockout to Enabled. Set Failed login attempts to 3 and Lockout threshold in minutes to 15.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Splunk_Enterprise_7-x_for_Windows_V3R1_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-7a., CAT|II, CCI|CCI-000044, Rule-ID|SV-221941r960840_rule, STIG-ID|SPLK-CL-000240, STIG-Legacy|SV-111331, STIG-Legacy|V-102387, Vuln-ID|V-221941

Plugin: Splunk

Control ID: 7d3992786abb026eef8833c326507bf1a730fb0f2fce2f683a212318e63466f3