{"id":26,"title":"Account Lockout Duration G\u00fcvenli\u011fi (Misconfiguration)","content":"

 <\/p>\n

Account Lockout Duration Güvenlik Aç\u0131\u011f\u0131<\/h1>\n

Brute Force Sald\u0131r\u0131lar\u0131na Kar\u015f\u0131 Koruma<\/h2>\n

Siber sald\u0131rganlar\u0131n en s\u0131k kulland\u0131\u011f\u0131 yöntemlerden biri olan brute force<\/strong> ve password spraying<\/strong> sald\u0131r\u0131lar\u0131, zay\u0131f hesap kilitleme politikalar\u0131n\u0131n bulundu\u011fu sistemlerde büyük ba\u015far\u0131 elde edebilir.<\/p>\n

Account Lockout Duration<\/strong> ayar\u0131n\u0131n yetersiz olmas\u0131, sald\u0131rganlar\u0131n sürekli parola deneme giri\u015fimlerinde bulunmas\u0131na olanak tan\u0131r. Bu yaz\u0131da, bu kritik güvenlik aç\u0131\u011f\u0131n\u0131<\/strong> ve etkili çözüm yöntemlerini<\/strong> detayl\u0131 olarak inceleyece\u011fiz.<\/p>\n

\n

Account Lockout Policy Nedir?<\/h2>\n

Account Lockout Policy<\/strong>, Windows Active Directory ortamlar\u0131nda kullan\u0131c\u0131 hesaplar\u0131n\u0131n ba\u015far\u0131s\u0131z giri\u015f denemelerinden sonra ne kadar süre kilitli kalaca\u011f\u0131n\u0131<\/strong> belirleyen kritik bir güvenlik mekanizmas\u0131d\u0131r.<\/p>\n

Bu politika üç temel bile\u015fenden<\/strong> olu\u015fur:<\/p>\n

\n

1. Account Lockout Threshold<\/h3>\n
    \n
  • \n

    Tan\u0131m:<\/strong> Hesab\u0131n kilitlenmesine neden olan ba\u015far\u0131s\u0131z giri\u015f denemesi say\u0131s\u0131<\/p>\n<\/li>\n

  • \n

    Önerilen De\u011fer:<\/strong> 3–5 deneme<\/strong><\/p>\n<\/li>\n

  • \n

    Etki:<\/strong> Çok dü\u015fük de\u011ferler DoS riskini<\/strong> art\u0131r\u0131r<\/p>\n<\/li>\n<\/ul>\n

    \n

    2. Account Lockout Duration<\/h3>\n
      \n
    • \n

      Tan\u0131m:<\/strong> Kilitli hesab\u0131n otomatik olarak aç\u0131lmas\u0131na kadar geçen süre<\/p>\n<\/li>\n

    • \n

      Minimum Güvenli De\u011fer:<\/strong> 15 dakika veya daha fazla<\/strong><\/p>\n<\/li>\n

    • \n

      Etki:<\/strong> Brute force sald\u0131r\u0131lar\u0131n\u0131 ciddi \u015fekilde yava\u015flat\u0131r<\/p>\n<\/li>\n<\/ul>\n

      \n

      3. Reset Account Lockout Counter After<\/h3>\n
        \n
      • \n

        Tan\u0131m:<\/strong> Ba\u015far\u0131s\u0131z deneme sayac\u0131n\u0131n s\u0131f\u0131rlanmas\u0131na kadar geçen süre<\/p>\n<\/li>\n

      • \n

        Önerilen De\u011fer:<\/strong> 15 dakika<\/strong><\/p>\n<\/li>\n

      • \n

        Kural:<\/strong><\/p>\n

        Lockout Duration ≥ Reset Counter Duration\n<\/code><\/pre>\n<\/li>\n<\/ul>\n
        \n
        Güvenlik Riskleri ve Sald\u0131r\u0131 Senaryolar\u0131<\/h2>\n
        1. Brute Force Sald\u0131r\u0131lar\u0131<\/h3>\n
        Geleneksel Brute Force<\/h4>\n
          \n
        • \n
          Tek bir hesap üzerinde sürekli parola denemeleri<\/p>\n<\/li>\n
        • \n
          K\u0131sa lockout süreleri sald\u0131r\u0131y\u0131 etkisiz hale getiremez<\/p>\n<\/li>\n
        • \n
          Otomatik araçlarla 7\/24 sald\u0131r\u0131<\/strong><\/p>\n<\/li>\n<\/ul>\n
          Distributed Brute Force<\/h4>\n
            \n
          • \n
            Farkl\u0131 IP adreslerinden e\u015fzamanl\u0131 sald\u0131r\u0131<\/p>\n<\/li>\n
          • \n
            Botnet kullan\u0131m\u0131<\/p>\n<\/li>\n
          • \n
            Lockout mekanizmas\u0131n\u0131n dolayl\u0131 bypass edilmesi<\/p>\n<\/li>\n<\/ul>\n
            \n
            2. Password Spraying Sald\u0131r\u0131lar\u0131<\/h3>\n
            Sald\u0131r\u0131 Mant\u0131\u011f\u0131<\/h4>\n
              \n
            • \n
              Çok say\u0131da kullan\u0131c\u0131 hesab\u0131na kar\u015f\u0131 az say\u0131da yayg\u0131n parola<\/strong><\/p>\n<\/li>\n
            • \n
              Hesap kilitleme e\u015fi\u011fi a\u015f\u0131lmaz<\/p>\n<\/li>\n
            • \n
              Kurumsal parola al\u0131\u015fkanl\u0131klar\u0131 istismar edilir<\/p>\n<\/li>\n<\/ul>\n
              Yayg\u0131n Parola Listeleri<\/h4>\n
                \n
              • \n
                Password123!<\/code><\/p>\n<\/li>\n
              • \n
                \u015eirket_Ad\u01312024!<\/code><\/p>\n<\/li>\n
              • \n
                Mevsim + y\u0131l kombinasyonlar\u0131<\/p>\n<\/li>\n
              • \n
                Varsay\u0131lan sistem parolalar\u0131<\/p>\n<\/li>\n<\/ul>\n
                \n
                3. Account Lockout DoS Sald\u0131r\u0131lar\u0131<\/h3>\n
                Kötü Niyetli Kilitleme<\/h4>\n
                  \n
                • \n
                  Me\u015fru kullan\u0131c\u0131lar\u0131 sistemden uzak tutma<\/p>\n<\/li>\n
                • \n
                  \u0130\u015f süreklili\u011fini bozma<\/p>\n<\/li>\n
                • \n
                  Help desk yükünü art\u0131rma<\/p>\n<\/li>\n<\/ul>\n
                  Timing Sald\u0131r\u0131lar\u0131<\/h4>\n
                    \n
                  • \n
                    Kritik i\u015f saatlerinde sald\u0131r\u0131<\/p>\n<\/li>\n
                  • \n
                    Yönetici hesaplar\u0131n\u0131 hedefleme<\/p>\n<\/li>\n
                  • \n
                    IT ekiplerini me\u015fgul etme<\/p>\n<\/li>\n<\/ul>\n
                    \n
                    Çözüm Yöntemleri<\/h2>\n
                    1. Group Policy (GPO) ile Yap\u0131land\u0131rma<\/h3>\n
                    Ad\u0131m 1:<\/strong><\/p>\n
                    gpmc.msc\n<\/code><\/pre>\n
                    Ad\u0131m 2:<\/strong><\/p>\n
                    Computer Configuration\n→ Windows Settings\n→ Security Settings\n→ Account Policies\n→ Account Lockout Policy\n<\/code><\/pre>\n
                    Önerilen Güvenlik Yap\u0131land\u0131rmas\u0131<\/h4>\n
                      \n
                    • \n
                      Account lockout threshold:<\/strong> 5 invalid logon attempts<\/p>\n<\/li>\n
                    • \n
                      Account lockout duration:<\/strong> 15 dakika (veya daha fazla)<\/p>\n<\/li>\n
                    • \n
                      Reset account lockout counter after:<\/strong> 15 dakika<\/p>\n<\/li>\n<\/ul>\n
                      \n
                      2. PowerShell ile Toplu Yap\u0131land\u0131rma<\/h3>\n
                      Mevcut Ayarlar\u0131 Görüntüleme<\/h4>\n
                      Get-ADDefaultDomainPasswordPolicy\nGet-ADPasswordPolicy -Filter *\n<\/code><\/pre>\n
                      Yeni Ayarlar\u0131 Uygulama<\/h4>\n
                      Set-ADDefaultDomainPasswordPolicy `\n -Identity \"yourdomain.com\" `\n -LockoutDuration \"00:15:00\" `\n -LockoutObservationWindow \"00:15:00\" `\n -LockoutThreshold 5\n<\/code><\/pre>\n
                      \n
                      3. Fine-Grained Password Policy (FGPP)<\/h3>\n
                      Yönetici Hesaplar\u0131 için<\/h4>\n
                      New-ADPasswordPolicy -Name \"AdminLockoutPolicy\" `\n -Precedence 10 `\n -LockoutDuration \"00:30:00\" `\n -LockoutObservationWindow \"00:30:00\" `\n -LockoutThreshold 3\n\nAdd-ADPasswordPolicySubject `\n -Identity \"AdminLockoutPolicy\" `\n -Subjects \"Domain Admins\"\n<\/code><\/pre>\n
                      \n
                      Örnek Lockout Policy Tablosu<\/h3>\n\n\n\n\n\n\n\n\n
                      Kullan\u0131c\u0131 Türü<\/th>\nThreshold<\/th>\nDuration<\/th>\nReset Counter<\/th>\n<\/tr>\n<\/thead>\n
                      Normal Kullan\u0131c\u0131<\/td>\n5<\/td>\n15 dk<\/td>\n15 dk<\/td>\n<\/tr>\n
                      Yönetici<\/td>\n3<\/td>\n30 dk<\/td>\n30 dk<\/td>\n<\/tr>\n
                      Servis Hesab\u0131<\/td>\n10<\/td>\n60 dk<\/td>\n60 dk<\/td>\n<\/tr>\n
                      Privileged User<\/td>\n3<\/td>\n60 dk<\/td>\n60 dk<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
                      \n
                      Geli\u015fmi\u015f Güvenlik Stratejileri<\/h2>\n
                      1. Conditional Access Policies<\/h3>\n
                        \n
                      • \n
                        Azure AD entegrasyonu<\/p>\n<\/li>\n
                      • \n
                        Risk bazl\u0131 eri\u015fim k\u0131s\u0131tlamalar\u0131<\/p>\n<\/li>\n
                      • \n
                        \u015eüpheli oturumlar\u0131 otomatik engelleme<\/p>\n<\/li>\n<\/ul>\n
                        \n
                        2. Smart Lockout Mekanizmalar\u0131<\/h3>\n
                        Adaptive Lockout<\/h4>\n\n\n\n\n\n\n\n\n
                        Deneme Say\u0131s\u0131<\/th>\nLockout Süresi<\/th>\n<\/tr>\n<\/thead>\n
                        1–3<\/td>\n15 dakika<\/td>\n<\/tr>\n
                        4–6<\/td>\n30 dakika<\/td>\n<\/tr>\n
                        7–9<\/td>\n60 dakika<\/td>\n<\/tr>\n
                        10+<\/td>\n24 saat<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
                          \n
                        • \n
                          Co\u011frafi konum analizi<\/p>\n<\/li>\n
                        • \n
                          Kullan\u0131c\u0131 davran\u0131\u015f profilleme<\/p>\n<\/li>\n<\/ul>\n
                          \n
                          3. Multi-Factor Authentication (MFA)<\/h3>\n
                            \n
                          • \n
                            \u0130lk ba\u015far\u0131s\u0131z denemeden sonra MFA<\/p>\n<\/li>\n
                          • \n
                            \u015eüpheli IP’ler için ek do\u011frulama<\/p>\n<\/li>\n
                          • \n
                            Co\u011frafi anomali tespiti<\/p>\n<\/li>\n<\/ul>\n
                            \n
                            Monitoring ve Alerting<\/h2>\n
                            1. Event Log \u0130zleme<\/h3>\n
                            Kritik Event ID’ler:<\/strong><\/p>\n
                              \n
                            • \n
                              4740:<\/strong> Account locked out<\/p>\n<\/li>\n
                            • \n
                              4625:<\/strong> Failed logon attempt<\/p>\n<\/li>\n
                            • \n
                              4648:<\/strong> Explicit credentials<\/p>\n<\/li>\n
                            • \n
                              4771:<\/strong> Kerberos pre-authentication failed<\/p>\n<\/li>\n<\/ul>\n
                              \n
                              2. Automated Response<\/h3>\n
                                \n
                              • \n
                                Brute force tespiti<\/p>\n<\/li>\n
                              • \n
                                IP bazl\u0131 firewall bloklama<\/p>\n<\/li>\n
                              • \n
                                Otomatik e-posta uyar\u0131lar\u0131<\/p>\n<\/li>\n<\/ul>\n
                                \n
                                3. SIEM Entegrasyonu<\/h3>\n
                                  \n
                                • \n
                                  Splunk:<\/strong> Failed logon ve lockout korelasyonu<\/p>\n<\/li>\n
                                • \n
                                  ELK:<\/strong> IP bazl\u0131 sald\u0131r\u0131 tespiti<\/p>\n<\/li>\n<\/ul>\n
                                  \n
                                  Performans ve Kullan\u0131labilirlik<\/h2>\n
                                  Help Desk Yükü<\/h3>\n
                                    \n
                                  • \n
                                    Günlük kilitlenen hesap say\u0131s\u0131<\/p>\n<\/li>\n
                                  • \n
                                    Ortalama çözüm süresi<\/p>\n<\/li>\n
                                  • \n
                                    Tekrar eden kilitleme oran\u0131<\/p>\n<\/li>\n<\/ul>\n
                                    Optimizasyon:<\/strong><\/p>\n
                                      \n
                                    • \n
                                      Self-service password reset<\/p>\n<\/li>\n
                                    • \n
                                      Kullan\u0131c\u0131 fark\u0131ndal\u0131k e\u011fitimi<\/p>\n<\/li>\n<\/ul>\n
                                      \n
                                      Güvenlik Do\u011frulama ve Test<\/h2>\n
                                      Penetration Testing<\/h3>\n
                                        \n
                                      • \n
                                        Hydra<\/p>\n<\/li>\n
                                      • \n
                                        Medusa<\/p>\n<\/li>\n
                                      • \n
                                        Ncrack<\/p>\n<\/li>\n<\/ul>\n
                                        Policy Compliance Kontrolü<\/h3>\n
                                          \n
                                        • \n
                                          Lockout duration ≥ 15 dakika<\/p>\n<\/li>\n
                                        • \n
                                          Reset counter uyumlu mu?<\/p>\n<\/li>\n<\/ul>\n
                                          \n
                                          Sonuç ve Öneriler<\/h2>\n
                                          Account Lockout Duration<\/strong> ayar\u0131n\u0131n en az 15 dakika<\/strong> olarak yap\u0131land\u0131r\u0131lmas\u0131, brute force ve password spraying sald\u0131r\u0131lar\u0131na kar\u015f\u0131 etkili bir savunma mekanizmas\u0131d\u0131r<\/strong>.<\/p>\n
                                          Bu yap\u0131land\u0131rma, sald\u0131rganlar\u0131n sürekli parola deneme giri\u015fimlerini önemli ölçüde yava\u015flat\u0131r<\/strong> ve organizasyonun genel güvenlik seviyesini art\u0131r\u0131r.<\/p>\n
                                          \n
                                          Kritik Uygulama Ad\u0131mlar\u0131<\/h3>\n
                                          \u2705 Mevcut lockout policy’i analiz edin
                                          \u2705 Minimum 15 dakika duration ayarlay\u0131n
                                          \u2705 Reset counter ile uyumlu hale getirin
                                          \u2705 FGPP kullanarak özel gruplar tan\u0131mlay\u0131n
                                          \u2705 Monitoring ve alerting kurun
                                          \u2705 Help desk süreçlerini optimize edin<\/p>\n
                                          \n
                                          H\u0131zl\u0131 Kontrol Listesi<\/h3>\n
                                          \u2705 Account lockout duration ≥ 15 dk m\u0131?
                                          \u2705 Duration ≥ Reset counter m\u0131?
                                          \u2705 Kullan\u0131c\u0131 türlerine özel policy var m\u0131?
                                          \u2705 Brute force monitoring aktif mi?
                                          \u2705 MFA entegrasyonu tamam m\u0131?
                                          \u2705 Incident response plan\u0131 haz\u0131r m\u0131?<\/p>\n
                                          \n
                                          Geli\u015fmi\u015f Güvenlik Önerileri<\/h3>\n
                                            \n
                                          • \n
                                            Adaptive lockout mekanizmalar\u0131<\/p>\n<\/li>\n
                                          • \n
                                            Conditional access policy’leri<\/p>\n<\/li>\n
                                          • \n
                                            SIEM entegrasyonu<\/p>\n<\/li>\n
                                          • \n
                                            Düzenli penetration testing<\/p>\n<\/li>\n
                                          • \n
                                            Kullan\u0131c\u0131 fark\u0131ndal\u0131k e\u011fitimleri<\/p>\n<\/li>\n<\/ul>\n
                                            \n
                                            Bu yap\u0131land\u0131rmalar\u0131 uygulayarak, organizasyonunuzu brute force<\/strong>, password spraying<\/strong> ve di\u011fer parola tabanl\u0131 sald\u0131r\u0131lara kar\u015f\u0131 etkili \u015fekilde koruyabilir ve modern güvenlik standartlar\u0131na uygun<\/strong> bir kimlik do\u011frulama altyap\u0131s\u0131 olu\u015fturabilirsiniz.<\/p>","excerpt":"Account Lockout Duration G\u00fcvenlik A\u00e7\u0131\u011f\u0131 Brute Force Sald\u0131r\u0131lar\u0131na Kar\u015f\u0131 Koruma Siber sald\u0131rganlar\u0131n en s\u0131k kulland\u0131\u011f\u0131 y\u00f6ntemlerden...","created_at":"2025-07-16 23:52:48","updated_at":"2026-09-23 12:28:10","category_id":12,"view_count":611,"reading_time":6,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-07-16 23:52:48","featured_image":"\/uploads\/images\/2025\/12\/6947c51f3e40e_1766311199.jpg","slug":"account-lockout-duration-guvenligi-misconfiguration","category_name":"Misconfiguration","category_slug":"misconfiguration","category_color":"#84cc16"}