Enforce Automatic Device Lockout on Portable End-User Devices

To enforce automatic device lockout on portable end-user devices after a predetermined number of failed authentication attempts, the organization adopts several strategies. For laptops, the strategy involves reviewing password practices to implement a limit of 20 failed attempts before lockout. For tablets and smartphones, security policies are set to lock devices after 10 failed attempts. The implementation is supported by mobile device management (MDM) solutions, which enforce these security policies across devices.

To protect from e.g brute force attacks the organisation must use at least one of the following practices:

• Account is locked after 10 failed login attempts
• Limit for login attempts in 5 minutes is 10

In addition the following password practices should be in place:

• Minimum length of a password should be at least 8
• Passwords don’t have maximum length
• Password is changed when it’s integrity is suspected or known to be compromised