Account lockout
In Arabic قفل الحساب
Account lockout is a security control that blocks sign-in to an account for a period after a set number of wrong passwords, to stop passwords being guessed.
In plain words
Many passwords are short or reused, and an attacker who can try thousands of them will eventually get in. Lockout caps the number of tries: after a few wrong passwords the account refuses sign-in for a while, even with the right one, so guessing becomes too slow to work.
It is set by three numbers: how many wrong attempts, within what window, and how long the account stays locked. A lock that lifts on its own after some minutes stops guessing without leaving staff waiting for an administrator. It works best alongside a second sign-in step.
The common mistake is setting the limits too tight, such as three tries and a lock until an admin resets it. Staff then lock themselves out daily, and the help desk resets passwords without checking who is asking. Choose limits that stop machines, not people.
- Wrong passwords before the lock
- 5
- Lock length
- 15 minutes
- Guesses per hour, at most
- 20
- Guesses per day, at most
- 480
In Axon Suite
How Axon Suite handles it
In Axon Suite five wrong passwords in ten minutes lock the account for fifteen, and no sign-in is accepted until the lock expires, even with the right password.
Feature
Sign-in that resists guessing
Repeated wrong passwords lock the account. A reused session token ends the session outright. Office users can be asked for an authenticator code, and the office can sign a rep’s phone out remotely.
Open: Sign-in that resists guessing