Designing A Logical Authentication Strategy

By Author: Sarah Jones
Total Articles: 60
Comment this article

Considerations for Deciding to Design an Account Lockout Policy MCSE 2003
As mentioned earlier, an account lockout policy is a technical control that can block account access. There are benefits and drawbacks to using an account lockout policy, and you must decide what is right for your organization.
There are two schools of thought about whether using account lockout policies is a good idea. On one hand, an account lockout policy can prevent intrusion because it disables an account if multiple tries, or guesses at the password, have occurred. On the other hand, an account lockout policy can prevent legitimate but fumble-fingered or forgetful users from accessing critical data and might provide an opportunity for a suc?cessful denial of service (DoS) attack. An attacker could launch a DoS attack by rapidly attempting to crack multiple passwords. When the incorrect passwords eventually trig?ger account lockout, multiple users will be locked out of the domain and unable to do their work.
Self-Lockout
In spite of the real possibility that an attacker might successfully ...
... cause denial of service to an entire domain by attempting to crack the passwords of a domain with an account lockout policy in effect, I have not been seeing reports on this microsoft exams. However, a number of account lockout policies have caused companies harm. Several clients have told me that they abandoned account lockout policies after C-level (CEO, CIO, CTO, CSO, and so on) executives were locked out or when important sales were supposedly lost because top salesmen could not enter their password correctly and had no other way of reaching some required information.Standard permissions are composed of special permissions, which provide you with a finer degree of control for assigning access to objects. For example, the standard Write permission is composed of the Write All Properties and All Validated Writes special per?missions. Special permissions are also referred to as advanced security settings. You can view the special permissions in the Permission Entry dialog box for an object.
Guidelines for Designing an Account Lockout Policy
If you decide to design an account lockout policy, you must understand the account policy lockout controls and the guidelines for designing the policy.
Account Lockout Policy Controls
When developing account controls, assume that free practice exam questions account lockout policy will be accepted, but keep reasons for rejection in mind. Table 6-8 lists and explains the account lockout policy.