topic Re: Password Spraying Protection in General Topics

Password Spraying Protection

arnauec — Mon, 22 Oct 2018 11:18:36 GMT

Hi!

In my company we are using GlobalProtect VPN's as a medium to access the network.

Right now we have a blocking procedure by which if a user fails 5 times the password while trying to login, his account gets blocked for 15 minutes.

We are using this -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJ2CAK

Recently we have had an audit and they found out we were not protected against a Password Spraying attack so we would like to block users based on accumulation too.

So:

- If a user fails 5 times, block 15 minutes

- If a user fails 5 times more, block 1h

- If a user fails 5 times more, block 24h

I have not found anyone talking about this in the forum and I would like to know if there is any way to get this done within GlobalProtect.

Thank you very much!

Re: Password Spraying Protection

OtakarKlier — Mon, 22 Oct 2018 15:18:19 GMT

Hello,

While PAN does not offer this and neither does active directory, to my knowledge. You can protect yourself in other ways. Check out this article.

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/prevent-brute-force-attacks

Regards,

Re: Password Spraying Protection

BPry — Mon, 22 Oct 2018 17:10:10 GMT

@arnauec,

Do you have a DoS policy on this service at all? My line of thinking would be that usually a Password Spraying attack would be launched in rapid succession, which would cause a larger amount of sessions to be opened. You could use the DoS Session Limit to kind of prevent this and lock out the IP that the attack is being launched from.

Re: Password Spraying Protection

arnauec — Tue, 23 Oct 2018 11:32:09 GMT

Thing is that wouldn't be the case if the attacker uses proxies or SOCKS, so this isn't a viable solution.

Re: Password Spraying Protection

arnauec — Tue, 23 Oct 2018 11:34:40 GMT

I will check this out, but still it is a pitty that PAN doesn't offer this.

So just to be clear, the only thing I can do to block users who repeatedly fail login attempts is to lock them out for X minutes, always the same value, without being able increase that value dinamically?

Re: Password Spraying Protection

BPry — Tue, 23 Oct 2018 13:27:02 GMT

@arnauec,

At this time that's correct; there isn't an option to increase this on a regular basis and eventually block the account. There are some third party utilities that can do this for you based off of AD logs, but that's a totally different conversation.