Overview
CSC V8 control 4.10 recommends that organisations “Enforce automatic device lockout following a predetermined threshold of local failed authentication attempts on portable end-user devices, where supported. For laptops, do not allow more than 20 failed authentication attempts; for tablets and smartphones, no more than 10 failed authentication attempts. Example implementations include Microsoft InTune Device Lock and Apple Configuration Profile maxFailedAttempts.”.
Note
CSC V8 places this control in the category of “Secure Configuration of Enterprise Assets and Software”.
CSC V8 places this control in the function of “Respond”.
This control protects the following type of asset “Devices”.
What is CIS Critical Security Controls?
The CIS Controls (formerly known as Critical Security Controls) are a recommended set of actions for cyber defense that provide specific and actionable ways to protect against cyber attacks.
The Center for Internet Security (CIS) publishes the CIS Critical Security Controls (CSC) to help organizations better defend against known attacks by distilling key security concepts into actionable controls to achieve greater overall cybersecurity defense.