Password Spraying Protection
cancel
Showing results for 
Search instead for 
Did you mean: 

Password Spraying Protection

L1 Bithead

Hi!

In my company we are using GlobalProtect VPN's as a medium to access the network.

 

Right now we have a blocking procedure by which if a user fails 5 times the password while trying to login, his account gets blocked for 15 minutes.

We are using this -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJ2CAK

 

Recently we have had an audit and they found out we were not protected against a Password Spraying attack so we would like to block users based on accumulation too.

 

So:

- If a user fails 5 times, block 15 minutes

- If a user fails 5 times more, block 1h

- If a user fails 5 times more, block 24h

 

I have not found anyone talking about this in the forum and I would like to know if there is any way to get this done within GlobalProtect.

 

Thank you very much!

5 REPLIES 5

Cyber Elite
Cyber Elite

Hello,

While PAN does not offer this and neither does active directory, to my knowledge. You can protect yourself in other ways. Check out this article.

 

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/prevent-brute-forc...

 

Regards,

Cyber Elite
Cyber Elite

@arnauec,

Do you have a DoS policy on this service at all? My line of thinking would be that usually a Password Spraying attack would be launched in rapid succession, which would cause a larger amount of sessions to be opened. You could use the DoS Session Limit to kind of prevent this and lock out the IP that the attack is being launched from. 

Thing is that wouldn't be the case if the attacker uses proxies or SOCKS, so this isn't a viable solution.

 

I will check this out, but still it is a pitty that PAN doesn't offer this.

 

So just to be clear, the only thing I can do to block users who repeatedly fail login attempts is to lock them out for X minutes, always the same value, without being able increase that value dinamically?

@arnauec,

At this time that's correct; there isn't an option to increase this on a regular basis and eventually block the account. There are some third party utilities that can do this for you based off of AD logs, but that's a totally different conversation. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!