NIST 800-171 Control 3.5.11: Obscuring Authentication Feedback
Control 3.5.11 requires organizations to obscure authentication feedback to prevent attackers from gleaning sensitive information during login attempts. This critical control reduces account enumeration risks and credential harvesting by masking system responses. Proper implementation protects user identities while maintaining usable authentication experiences.
What this means
Obscuring authentication feedback means your system should not reveal whether a username exists, whether a password is correct, or provide timing differences that expose user account information. Instead of messaging like 'Username not found' or 'Invalid password,' use generic feedback such as 'Invalid credentials' for all failed authentication attempts. This prevents attackers from conducting user enumeration attacks or exploiting error messages to refine their attack strategies.
How to comply
- 1.Configure authentication systems to return identical, generic error messages for invalid usernames and invalid passwords (e.g., 'Invalid credentials')
- 2.Remove or mask system-generated feedback that could reveal account existence, such as 'user not found' or 'account locked'
- 3.Ensure response times for failed login attempts are consistent and do not leak timing information that distinguishes between username and password failures
- 4.Document all authentication feedback messages and review them quarterly for unintended information disclosure
- 5.Implement account lockout and multi-factor authentication without exposing which condition triggered the event
- 6.Test authentication flows with security tools to verify feedback obscuring is working across all authentication methods
Evidence auditors look for
- Screenshots of login error messages showing generic feedback text
- Authentication system configuration files demonstrating identical response messages for failed attempts
- Security testing reports (penetration test or vulnerability scan) confirming no user enumeration is possible via error messages
- Documentation of approved authentication feedback messages and change management records
- Logs showing consistent response handling for failed authentication requests
- Security code review comments or pull requests addressing feedback obscuring in login flows
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch's authentication control module automatically scans your login systems and error messages for unintended credential disclosure, flagging overly detailed responses and helping you standardize feedback across all authentication endpoints.
See how GRCWatch handles this control automatically
Start free trial