⛔
Account Lockout
Authentication
Control limiting authentication attempts by locking accounts or requiring additional verification after repeated failures.
Definition
Lockout reduces online brute-force, but must avoid denial-of-service where attackers lock victims out. Progressive delays and rate limiting are often safer.
In plain English
Control limiting authentication attempts by locking accounts or requiring additional verification after repeated failures.
Why this matters
Why it matters: Properly tuned lockout protects accounts without enabling easy abuse.
Example
Example: Use progressive delays, rate limiting per IP/device, and step-up verification rather than long lockouts.