I had a problem presented today which I found quite interesting.
You have an application with a management panel. You know some of the accounts as they are standard. You want two things:
- You want to prevent bruteforce attacks
- You want to prevent a denial of service
At the moment, the user accounts were locked after 5 tries. Meaning you had to reset the password through email. This mitigates the chance of a successful bruteforce attack.
On the other hand the risk is that because there are some default accounts, that someone intentionally keeps sending bad passwords to keep disabling the accounts. This would result in a kind of denial of service for the administrative accounts.
My solution was to make the management panel only accessible through a VPN. So you would first need access to the VPN before you would be able to attempt a login into the panel.
But what if this is not an option, what can you do? (apart from continuously blocking IP's that perform bruteforce attacks)