Password Spraying Protection

[arnauec]

Hi!

In my company we are using GlobalProtect VPN's as a medium to access the network.

Right now we have a blocking procedure by which if a user fails 5 times the password while trying to login, his account gets blocked for 15 minutes.

We are using this -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJ2CAK

Recently we have had an audit and they found out we were not protected against a Password Spraying attack so we would like to block users based on accumulation too.

So:

- If a user fails 5 times, block 15 minutes

- If a user fails 5 times more, block 1h

- If a user fails 5 times more, block 24h

I have not found anyone talking about this in the forum and I would like to know if there is any way to get this done within GlobalProtect.

Thank you very much!

[OtakarKlier]

Hello,

While PAN does not offer this and neither does active directory, to my knowledge. You can protect yourself in other ways. Check out this article.

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/prevent-brute-forc...

Regards,

[BPry]

@arnauec,

Do you have a DoS policy on this service at all? My line of thinking would be that usually a Password Spraying attack would be launched in rapid succession, which would cause a larger amount of sessions to be opened. You could use the DoS Session Limit to kind of prevent this and lock out the IP that the attack is being launched from. 

[arnauec]

Thing is that wouldn't be the case if the attacker uses proxies or SOCKS, so this isn't a viable solution.

[arnauec]

I will check this out, but still it is a pitty that PAN doesn't offer this.

So just to be clear, the only thing I can do to block users who repeatedly fail login attempts is to lock them out for X minutes, always the same value, without being able increase that value dinamically?

[BPry]

@arnauec,

At this time that's correct; there isn't an option to increase this on a regular basis and eventually block the account. There are some third party utilities that can do this for you based off of AD logs, but that's a totally different conversation.