STIGQter: STIG Summary: Ivanti Connect Secure NDM Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 01 Oct 2025:

The ICS must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes.

DISA Rule

SV-258624r960840_rule

Vulnerability Number

V-258624

Group Title

SRG-APP-000065-NDM-000214

Rule Version

IVCS-NM-000720

Severity

CAT II

CCI(s)

• CCI-000044 - Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.

Weight

10

Fix Recommendation

In the ICS Web UI, navigate to Authentication >> Auth Servers >> Administrators.
1. Under the section "Account Lockout", check the box for "Enable Account Lockout for users".
2. Under the section "Account Lockout", set the box "Maximum wrong password attempts" to "3".
3. Under the section "Account Lockout", set the box "Account Lockout Period in Minutes" to "15".
4. Click "Save Changes".

Check Contents

In the ICS Web UI, navigate to Authentication >> Auth Servers >> Administrators.
1. Under the section "Account Lockout", verify "Enable Account Lockout for users" is checked.
2. Under the section "Account Lockout", verify "Maximum wrong password attempts" is set to "3".
3. Under the section "Account Lockout", verify "Account Lockout Period in Minutes" is set to "15".

If the ICS must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes, this is a finding.

Vulnerability Number

V-258624

Documentable

False

Rule Version

IVCS-NM-000720

Severity Override Guidance

In the ICS Web UI, navigate to Authentication >> Auth Servers >> Administrators.
1. Under the section "Account Lockout", verify "Enable Account Lockout for users" is checked.
2. Under the section "Account Lockout", verify "Maximum wrong password attempts" is set to "3".
3. Under the section "Account Lockout", verify "Account Lockout Period in Minutes" is set to "15".

If the ICS must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes, this is a finding.

Check Content Reference

M

Target Key

5558