In order to inform the user of failed login attempts made with the users account, the application upon successful logon/access must display to the user the number of unsuccessful logon/access attempts since the last successful logon/access.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35267	SRG-APP-000076-MAPP-NA	SV-46554r1_rule		Medium

Description

Users need to be aware of activity that occurs regarding their application account. Providing users with information regarding the number of unsuccessful attempts made to login to their account allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators. This requirement is intended to cover both traditional logons to information systems and general accesses to information systems that occur in other types of architectural configurations (e.g., service oriented architectures). Rationale for non-applicability: This control is required in the MOS SRG. Mobile applications do not have additional authentication requirements. If the mobile application connects to a remote enterprise application, the remote application can provide any required notifications.

STIG	Date
Mobile Application Security Requirements Guide	2013-01-04

Details

Check Text ( C-43636r1_chk )
This requirement is NA for the MAPP SRG.

Fix Text (F-39813r1_fix)
The requirement is NA. No fix is required.