How many failures before wait is triggered.
When failure threshold has been met, how much time should the user be locked out?
If a failure happens concurrently too quickly, lock out the user.
How long to wait after a quick login failure.
Max time a user will be locked out.
When will failure count be reset?