Repeated attempts to guess database user passwords may be made through brute force techniques. This condition could result in unauthorized access if successful, compromising database security and sensitive information. Attempts arrive over whichever IPv4 or IPv6 endpoint the network access rules leave reachable.
Brute Force Attempts on Database Authentication
CCC.RDMS.TH02
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.RDMS.CP07 | DB Self Managed Credentials | The service always supports database users authenticated by a username and password that the user creates and manages. |
| CCC.RDMS.CP08 | Support for IPv4 | The service always exposes an IPv4 endpoint through which clients connect to the database. |
| CCC.RDMS.CP09 | Support for IPv6 | The service may be configured to expose an IPv6 endpoint through which clients connect to the database. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.RDMS.CN02 | Account Lockout and Rate-Limiting | Ensure the database enforces lockouts or rate-limiting after a specified number of failed authentication attempts. This prevents brute force or password-guessing attacks from succeeding. |