The Riverbed NetIM must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes.

By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced.

Verify Password Rules are configured for "Maximum failed login attempts allowed".

1. From the GUI, navigate to Configuration >> Configure >> All Settings >> Administer. 2. On the User Management screen, select "Password Rules". 3. Verify "Maximum failed login attempts allowed" is checked and set to "3". 4. Verify "Time interval for max failed login attempts in minutes" is set to "15".

If both "Maximum failed login attempts allowed" is not set to "3" and the "Time interval for max failed login attempts in minutes" is set to "15", this is a finding.

Configure the Password Rules for Maximum failed login attempts allowed.

1. From the GUI, navigate to Configuration >> Configure >> All Settings >> Administer. 2. On the User Management screen, select "Password Rules". 3. Check the box for "Maximum failed login attempts allowed". 4. Enter "3" in the option box. 5. Check the box for "Time interval for max failed login attempts in minutes". 6. Enter "15" in the option box and click "Submit".

Note: Local users must not be created; however, setting these requirements are a good best practice.