We are implementing a temporary account lockout after throttling login attempts and actively directing users to reset their password. Users can still go through the reset journey even during temporary lockout.
The rationale being that instead of completely locking the account after many failed login attempts, we could lock the account temporarily to encourage users to reset their password and avoid unessessary calls to customer service.
So my question refers specifically to the time frame for temporary lockout.
Are we dealing with minuets or hours? What other considerations should I take into account to help users before making a viable suggestion? For example as this is an enterprise
Update: So far what I have suggested was as follows: 5 login attempts > temporary lockout for 15 min > next 5 login attempts 30min etc. The idea here was also to encourage users to think about resting their password particularly after having expired 5 login attempts.
This is for a software as a service web app where we do hold sensitive data and clients have their own internal security policies that we need to abide by. so really its not worth the fight. So the approach i am trying to take here is: What we can't control we can manage, hence my question.