🏛️NIST 800-53 AC-7Rule: NIST-AC-007high

Unsuccessful Logon Attempts

Description

Enforce a limit on consecutive invalid logon attempts; automatically lock the account / node / device when the limit is exceeded.

⚠️ Risk Impact

Without lockout, an attacker can perform unlimited brute-force or credential-stuffing attacks. Modern adversaries automate millions of attempts per hour; rate-limit + lockout is the bare minimum defense.

🔍 How EchelonGraph Detects This

NIST-AC-007Automated scanner rule

EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as high-severity findings with remediation guidance.

🔧 Remediation

Configure account lockout: 5 failed attempts in 15 minutes triggers 30-minute lockout. Apply at the IdP, every SaaS application, and every administrative interface. Monitor + alert on repeated lockouts (signal of attack in progress).

💀 Real-World Attack Scenario

A federal agency cloud admin console had no failed-login throttling. An attacker who obtained a leaked email list from a separate breach ran credential stuffing against the agency at 200 req/sec for 18 hours. They achieved 14 valid logins, including one with privileged access. The agency had no alert on repeated failed attempts because no lockout policy was in place.

💰 Cost of Non-Compliance

Credential-stuffing breach cost: avg $4.45M (IBM 2024). FedRAMP AC-7 violations: blocks ATO renewal. State breaches caused by absent lockout: avg $5.8M with mandatory notification to citizens.

📋 Audit Questions

  • 1.What is the lockout threshold and duration on production accounts?
  • 2.How are repeated failed logins surfaced as alerts?
  • 3.Show last 30 days of lockout events. Any indicators of brute force?

🎯 MITRE ATT&CK Mapping

T1110 — Brute ForceT1110.003 — Password SprayingT1110.004 — Credential Stuffing

⚡ Common Pitfalls

  • ⛔Lockout on production but not on staging/dev (attackers pivot through unprotected environments)
  • ⛔5-minute lockout that doesn't actually slow automated tooling
  • ⛔No alerting on lockouts — auto-lock fires silently while attack continues

📈 Business Value

Account lockout is the highest-ROI single control against credential-stuffing. Microsoft reports lockout + MFA blocks >99.9% of automated attacks.

⏱️ Effort Estimate

Manual

4-8 hours to configure across IdP + SaaS estate

With EchelonGraph

EchelonGraph audits lockout configuration across cloud + SaaS providers; alerts on misconfigurations

🔗 Cross-Framework References

SOC2-CC6.1ISO27001-A.8.5PCI-8.4

Automate NIST 800-53 AC-7 compliance

EchelonGraph continuously monitors this control across all your cloud accounts.

Start Free →