Tuning Account Banning
The settings look identical to the address ones. The reasoning behind them is not.
Where to find it
Architect Panel → Security:
- Security Settings — the three account banning settings
- Blocked User Accounts — the effect
- Two-Factor Authentication — the control that actually solves this
The asymmetry that matters
With address banning, a longer ban costs the attacker a lot and a legitimate user very little.
With account banning it is the reverse. A long ban on an account is a long lock-out for its owner — and because anybody who knows a username can trigger it deliberately, a long account ban hands out a denial-of-service tool for free.
So: lengthen address bans, keep account bans short.
Sensible ranges
- Attempts — 5 to 15, as with addresses.
- Monitoring Period — 5 to 30 minutes.
- Ban Length — 5 to 15 minutes. Rarely longer.
Do not disable it to stop the complaints
If lock-outs are generating support volume, the causes are usually a saved credential somewhere retrying, a shared account several people use, or a password policy people cannot comply with. Each has a proper fix.
Turning the rule off removes the symptom and the protection together, and it is the change most likely to be regretted.
Shared accounts are the usual culprit
An account several people use will trip the rule constantly, because a failure by any one of them counts against all of them. It is also poor practice for every other reason — the audit trail cannot attribute anything.
Repeated bans on one account are often the first visible symptom of account sharing, and worth following up as such.
When an account is being targeted
Tuning is not the answer. In order of usefulness: require a second factor on that account, check whether the username is unnecessarily guessable, and look at whether the address-level rule can be tightened for the administrative surface specifically.
Consider the administrative surface separately
Administrator accounts are what attackers want and are few enough that stricter settings cost little. Where you can apply a stricter posture to that surface, do — and leave the general settings suited to the people who will actually trip them.
Review after changing
Watch the blocked account list and your support volume for a week. Both react quickly, and a change that produces neither effect probably did not need making.
Worked example
A helpdesk reports frequent lock-outs. Rather than raising the attempt count, the team looks at the blocked account list and finds three accounts responsible for most of it — two shared between staff, one with a stale credential in an old mobile app. The shared accounts are split into individual ones and the app is reconfigured. Lock-outs fall away without a single setting being changed.
Recommendations
- Keep account bans short — 5 to 15 minutes.
- Never disable the rule to reduce support calls.
- Look at which accounts are being banned before touching thresholds.
- Answer a targeted account with a second factor, not with tuning.