I have to set up a server that will allow remote logins. Obviously security is an issue. In this first pass we are discussing:-

  1. Locking a person for 15 minutes if they fail to login correctly three times in succession over a five minute period.
  2. Locking them out totally and making them reset their password if they fail to login correctly, say, a dozen times in succession in any one 24 hour period.

It has been suggested to me that these settings are a bit harsh! Are there any guidelines on this? Information on the subject seems (from my Googles) somewhat limited.

Thank you...


1 Answer 1


There is no right or wrong answer. If you implement a more aggressive lockout policy then you will be more secure and you will degrade your user experience.

You have to assess where the right balance is for yourself, based on your application's requirements, your knowledge of your user base, the value of the assets you are protecting, your threat model, your risk analysis results, etc. etc.

  • The eternal balance between 'usability' and 'security'.
    – schroeder
    Commented Mar 2, 2015 at 18:20

Not the answer you're looking for? Browse other questions tagged .