💼 4.2.1 Passwords are protected against brute-force password guessing

• Contextual name: 💼 4.2.1 Passwords are protected against brute-force password guessing
• ID: /frameworks/uk-cyber-essentials-v3.1/04/02/01
• Located in: 💼 4.2 Authenticate users with unique credentials before granting access to applications or devices

Description

Passwords are protected against brute-force password guessing by implementing at least one of:

• multi-factor authentication
• 'throttling' the rate of attempts, so that the number of times the user must wait between attempts increases with each unsuccessful attempt – you shouldn’t allow more than 10 guesses in 5 minutes
• locking accounts after no more than 10 unsuccessful attempts

Similar

• Internal
  • ID: dec-c-1034bcf7

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags