I am currently building security into a website. So far, I have the following rules, and am wondering if this seems sufficient.
5 failed login attempts for a particular username will cause that account to be locked for 1 hour
The number of failed login attempts by IP address will be stored in the server cache. If an IP address has 2 failed login attempts within a 2 minute period, then a Captcha (Google Recaptcha) will be shown which must be filled in before they can re-attempt another login.
The 2nd and subsequent failed login attempts would be recorded in the database (IP address, username attempting to login as, and timestamp)
If an IP address exceeds 30 failed login attempts, then the login page would be blocked for that IP address for 2 minutes (eg via Response.End()). I want to slow down brute force attacks, but also still allow large companies/institutions/universities/etc that may have many users behind a single IP address to still be able to login even though there may be several failed logins for completely different users within a short amount of time.
Log tables could be reviewed periodically to enforce more permanent bans, eg at the firewall level.
Does this sound like an ok strategy, or could there be any improvements?