PCI 8.6.1 says:

Limit repeated access attempts by locking out the user ID after not more than six attempts.

But says nothing about a minimum duration between the first failed login attempt and the last failed login attempt. If a user fails to login 6 times over a 2 minute period, obviously he should be locked out. But what if he fails to login 6 times over a 2 day period? Would it be reasonable to assign each login attempt an expiration date (say, 12 hours)? Would this violate PCI requirements?

  • Most of the time this requirement solved with Microsoft Active Directory which is not ask any time configuration this why I couldn't understood your request. Could you please provide more information about your system. – alnbhclyn May 29 '19 at 19:59
  • @alnbhclyn I cannot go into any details about our system or why we choose not to use AD, so as not to reveal any identifying information about our organization. We use our own authentication system which are are seeking to upgrade to be PCI compliant. I would just like to know whether or not PCI has anything to say about the attempted login window duration. Otherwise we will just define our own sane duration (say, 1 hour). – mario_sunny May 29 '19 at 20:32
  • Allright, first of all this was my mistake, there is a configuration for this threshold which is named as "Reset account lockout counter after". Microsoft guideline says "Windows security baselines recommend configuring the Reset account lockout counter after policy setting to 15, but as with other account lockeout settings, this value is more of a guideline than a rule or best practice because there is no one size fits all.". I believe 1 hour will be fine but be prepared to questions, auditor will ask "what if" so know details what is the solution and how it works. – alnbhclyn May 29 '19 at 21:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.