1

Some corporate applications are most useful when they are accessible from the internet. Outlook Web Access comes to mind.

Those application usually have a user directory (usually LDAP) in the corporate environment that serves other purposes, like desktop authentication or authentication to some other internal only service like an HR portal.

Using the external application, it is often possible to lock an internal account by trying to guess passwords by brute force. A targeted manual attack also works. Mitigating factors include not divulging user names, and unlocking accounts after a few minutes.

Seeing how frequent we see this combination, how can I evaluate the risk of locking an internal account by using an internet facing application? Is the risk small enough, and is the benefit high enough so that everyone can accept this risk?

Improve this question
1
  • 2
    Locking the username only on the application layer and not in the LDAP directory would greatly reduce the harm, because the user would only be prevented from accessing that app and not be completely unable to work.
    – Philipp
    Commented Jan 5, 2015 at 8:13

1 Answer 1

Reset to default
1

You could try to implement a captcha on the logging page of the web application after the first try to reduce DoS situations.

Also, banning the IP which has several failed logging attempts could help prevent such situation. fail2ban is commonly used in UNIX environments for this purpose.

Also, using unpredictable usernames could reduce the risks.

Improve this answer
2
  • Thank you. That would reduce risk indeed, but I am looking for a way to quantify risk...
    – ixe013
    Commented Jan 6, 2015 at 15:14
  • In most cases, there is not much risk in everyday use. There are scanners that will try almost any "admin" account they could figure (root, admin and such) on open ports but that shouldn't worry you much. But a DoS situation is too easy to achieve, so take precautions: your LDAP admin account should not be usable from your application. Also, lock LDAP accounts only for a certain amount of time. If you use the LDAP server to authenticate into internal systems, make sure to use independent branches or having a backup local user.
    – NuTTyX
    Commented Jan 6, 2015 at 17:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .