Account protection analyzes the client's business object to see whether it has account security risks, such as weak passwords, password brute-force attacks, and abnormal login. It helps the client visually analyze the security risks of the account and provides corresponding fixing and protection advice, reducing the security risks of the client's business assets by blocking attacks from the source of attacks.

Additionally, it can also help customers sort out the login URL/ports of all business assets, visually analyze whether any unnecessary login URL/ports have been developed for the business assets on the LAN, and give management suggestions accordingly, to assist customers in effectively reducing asset exposure.

Prerequisites of this feature:

5. Go to Objects > Security Policy Template > Intrusion Prevention to enable Brute-force attack protection.
6. Go to Objects > Security Policy Template > Web App Firewall to enable Password Protection. Ensure that all features for weak password detection are enabled.
7. Go to Policies > Security Policy > Security Protection Policy to correlate more than two templates. You can see the effect only after the corresponding data is detected. For the first use, the following page is displayed.

Click Get Started. The effect page is displayed as shown below.

Login URL/Port: Any login operation, no matter successful or not, will be detected as "Login URL/Port" by the NGAF. The NGAF will record the specific login address of an account, helping customers sort out the Login URL/Port. The interface mainly displays the protocol and address of the login;

Weak Password: It mainly helps customers sort out the business assets involving weak passwords, and assists administrators in identifying which account has a weak password. The interface mainly displays the account type, account name, and login URL/port, and also supports the export and fuzzy search of weak passwords;

Brute-Force Attack: The login account has abnormalities like multiple login attempts and login failure, and the NGAF will detect it as a "brute-force attack". The NGAF will record the source of the attack and block the IP addresses permanently to stop the source of brute-force attack in time;

Suspicious Login: The successful login through multiple brute-force attacks will be detected as "Suspicious Login". The NGAF mainly displays the suspicious login, attack source, and brute-force times, etc.