TechKnowSurge

VideoSecurityFree

Account Lockout

Account lockouts can signal a brute force attack, where an adversary repeatedly attempts username and password combinations until access is gained or the account is blocked. Account lockout policies limit login attempts to mitigate this risk.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Account lockout policies are a fundamental access control mechanism designed to limit the feasibility of brute force attacks. By capping the number of failed login attempts — commonly three to five — and enforcing a waiting period after the threshold is reached, organizations remove the open-ended trial-and-error opportunity that attackers rely on. Without such a policy, an adversary can systematically cycle through large volumes of username and password combinations until a valid set is found. The same behavior that causes a legitimate user to trigger a lockout after forgetting a password also mirrors the pattern of a credential-based attack. The key difference lies in volume and intent. When account lockouts occur at an unusual frequency, across multiple accounts, or outside of normal business hours, they should be treated as a potential indicator of compromise. Security teams monitoring authentication logs can use lockout events as an early warning sign that a brute force or credential stuffing attack may be in progress.

What you'll learn

Explain how account lockout policies mitigate brute force attacks and identify account lockout as a potential indicator of compromise

What's covered

Account Lockout Policy

Why Lockouts Occur
- Users Forget Passwords
- Adversaries Brute Force
Account Lockout Policy
- Limited Login Attempts
  - 3 to 5 tries allowed
- Mandatory Wait Period
  - Wait 5 minutes
Brute Force Attack Risk
- Many Username/Password Combos
- Unlimited Tries Enables Attack
Lockout as Attack Indicator
- Possible Compromise Sign
- Repeated Failed Logins

Key terms

Brute Force Attack: An attack method that systematically tries all possible combinations of passwords or keys until the correct one is found.
Account Lockout Policy: A security policy that limits the number of failed login attempts allowed before an account is temporarily or permanently locked, preventing repeated unauthorized access attempts.
Indicators of Compromise: Indicators of Compromise are forensic artifacts such as file hashes, IP addresses, domain names, and registry keys that provide evidence a system may have been compromised, enabling threat detection and intelligence sharing.

Topics

Account Lockout Brute Force Attacks Authentication Identity And Access Management Indicators Of Compromise Cybersecurity

Transcript

If an adversary is trying a bunch of passwords on an account, then they could get account lockout. That would be another indicator.

There have been many times when I've had users forget their passwords. They remember vaguely what it was, and so they're trying different combinations. If we allow them to just keep trying combinations, this opens us up for risk. The reason why is because if they can try many times, many different combinations, so can an attacker. So can an adversary. They'll try as many times as it takes for them to get into the system.

So what we do is we develop an account lockout policy. An account lockout policy just says we're only going to allow them to try five times and then they can't log in, or four times, or three times, or whatever. Often that's accompanied with a policy that says then they have to wait five minutes. So if they've entered it in three times and got it wrong all three times, then they have to wait five minutes. This stops it from being really feasible for an adversary to try a ton of usernames and passwords and do that brute force attack.

This is why, if there is an account lockout, it could be a sign that there's an attack going on, that there could be somebody that's trying a bunch of different usernames and passwords to see what combination actually gets them into it. So much so that they try it so many times that they get locked out of their account and can't try anymore. So an account lockout could be an indicator that there's some sort of compromise or attack.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →