Enforce Automatic Device Lockout on Portable End>User Devices
Description
Enforce automatic device lockout following a predetermined threshold of local failed authentication attempts on portable end-user devices, where supported. For laptops, do not allow more than 20 failed authentication attempts; for tablets and smartphones, no more than 10 failed authentication attempts. Example implementations include Microsoft® InTune Device Lock and Apple® Configuration Profile maxFailedAttempts.
Implementation Checklist
Tool Recommendations
Cloud-native endpoint protection platform with next-gen AV, EDR, threat intelligence, and managed hunting
CrowdStrike · Per-endpoint subscription
Enterprise endpoint security with threat prevention, EDR, automated investigation, and attack surface reduction
Microsoft · Per-device subscription (P1/P2)
AI-powered endpoint protection with autonomous response, EDR, and XDR capabilities across endpoint, cloud, and identity
SentinelOne · Per-endpoint subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Brute-Force Password Attack on Lost Device
ConfidentialityAn attacker with physical possession of a lost or stolen portable device attempts unlimited password guesses to unlock the device and access all stored data and credentials.
Automated PIN Cracking on Mobile Devices
ConfidentialitySpecialized tools perform rapid automated PIN or passcode brute-force attempts against mobile devices without lockout protections, cracking short PINs in minutes.
Vulnerabilities (When Safeguard Absent)
No Failed Authentication Lockout on Portable Devices
Without automatic lockout after failed authentication attempts, attackers can perform unlimited brute-force password guessing against portable devices.
Inconsistent Lockout Thresholds Across Device Types
Without enforced lockout policies for laptops and mobile devices, some devices allow unlimited authentication attempts while others may have inadequate thresholds.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Document | Response procedure/playbook documentation | Reviewed bi-annually |
| Record | Response action logs showing procedure execution | Per incident |
| Technical | Configuration compliance scan results against approved baseline | Scanned monthly |
| Document | Approved baseline configuration documentation | Reviewed quarterly |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |