How do you handle account lockout policies and lockout thresholds?

• A. Set threshold, duration; allow unlock by self-service or admin after reset and avoid denial-of-service risk.
• B. Disable lockouts entirely.
• C. Lockouts are never used.
• D. Increase password length only.

Answer: (A)

Handling account lockout policies means balancing protection against brute-force attempts with keeping access usable. The best approach is to configure a limit on failed login attempts (the threshold) and a lockout duration so that after reaching that limit, the account is temporarily locked. Crucially, there should be a clear path to regain access, such as self-service unlock after a password reset or an admin unlock with identity verification. This combination helps stop automated guessing without creating a persistent, user-unfriendly block or exposing the system to denial-of-service risks from endlessly locked accounts.

Disable lockouts or say they’re never used leaves accounts highly vulnerable to brute-force attacks, defeating the purpose of the policy. Merely increasing password length doesn’t address repeated guess attempts and security controls beyond password complexity are needed. By pairing thresholds with a reasonable lockout duration and supported unlock methods, you strike a practical security balance and maintain access for legitimate users.