Lessons · Cybersecurity · failed logins in a row
Failed logins: what a count means
A few failures from one person is somebody mistyping; many failures on one account is guessing; one failure each on many accounts is a stolen list being tried; and any run of failures followed by a success is the one you report.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
The dashboard says 'failed logins: 312'. On its own that is meaningless. Broken up by account, by source and by what happened next, it is either a busy Monday morning or somebody already inside.
How to think about it
Never read the total. Split it three ways: how many per account, how many per source address, and what happened after the failures. Then work out the rate, because 20 failures over a day and 20 in a minute are different events.
Worked example
3 failures then a success, one account, one address, office hoursSomebody mistyped. Normal, and it is normal because of what came before and after.
60 failures on one account from one address in 120 secondsRate: 60 / 120 = 0.5 per second. Guessing, and no human types that fast.
400 failures, 400 accounts, one attempt each, many addressesA stolen list being tried. Credential stuffing, not guessing.
Any of those followed by an accepted login: report itThe failures stop being the story the moment one of them succeeds.
Your turn
Thirty failed logins in 2 minutes. Write the line that gives the rate per minute.
rate = 30 /
Solve one, graded on the server
The trap
Raising a ticket for the count and closing it when the count drops. The count dropping because the attacker got in looks exactly like the count dropping because they gave up.