Some corporate applications are most useful when they are accessible from the internet. Outlook Web Access comes to mind.
Those application usually have a user directory (usually LDAP) in the corporate environment that serves other purposes, like desktop authentication or authentication to some other internal only service like an HR portal.
Using the external application, it is often possible to lock an internal account by trying to guess passwords by brute force. A targeted manual attack also works. Mitigating factors include not divulging user names, and unlocking accounts after a few minutes.
Seeing how frequent we see this combination, how can I evaluate the risk of locking an internal account by using an internet facing application? Is the risk small enough, and is the benefit high enough so that everyone can accept this risk?