topic Re: IPS & Dictionary Attacks / Multiple Failed Logon Attempts in Network Security

IPS & Dictionary Attacks / Multiple Failed Logon Attempts

GoldleafIT — Sun, 10 Mar 2019 11:12:12 GMT

Could anyone enlighten me on answering this question:

Could an ASA 5520(IPS) stop a dictionary attack from happening and could it pickup alerts for multiple failed logon attempts inside the network?

Any help would be great. Thanks.

Re: IPS & Dictionary Attacks / Multiple Failed Logon Attempts

mhellman — Thu, 17 Jul 2008 16:00:55 GMT

Probably, but it depends entirely on which protocol you're talking about. I have attached a snapshot of signatures containing "authorization failure" in the name. there may be others. You should be able to use these (or a variant) to do what you want.

Re: IPS & Dictionary Attacks / Multiple Failed Logon Attempts

GoldleafIT — Fri, 18 Jul 2008 11:17:56 GMT

mhellman,

Can you post the contents of your attachment? I am not going to open a file on a blog.

Re: IPS & Dictionary Attacks / Multiple Failed Logon Attempts

mhellman — Fri, 18 Jul 2008 12:11:50 GMT

It's a jpeg image file. Sorry, no...I'm not going to transcribe the text in the image. FWIW, your browser automatically fetches and open hundreds, probably thousands, of remote images every day as you use the web. The risk is exactly the same. The ONLY different is that you don't have to think about it;-)

Re: IPS & Dictionary Attacks / Multiple Failed Logon Attempts

GoldleafIT — Fri, 18 Jul 2008 16:44:59 GMT

Thanks for your feedback.

Re: IPS & Dictionary Attacks / Multiple Failed Logon Attempts

zvadim — Fri, 25 Jul 2008 16:05:21 GMT

thank you, i was looking for an answer to this for a while!