I think you can take a page out of how cell phones implement this type of functionality.
The "hangup" button actually does 2 things:
- A quick press allows one to exit from menus, or do any form of cancellation.
- A long press allows one to turn the phone on and off.
The long press tends to take about 4 to 5 seconds to activate with most of the phones I have used, so I would say 4 to 5 seconds is a good range.
However, if this is for a web application, users are more accustomed to "clicks. There fore a long press of about 3 seconds should be enough. You should also provide visual indication of a "long press" being held.