SRS-089 Implement progressive delays between failed login attempts.
Identifier​
SRS-089
Software System​
- Authentication Service
Category​
- Security
Description​
To slow the rate of automated brute-force attacks, the system shall impose a mandatory time delay after each failed login attempt. This delay shall increase progressively with each subsequent consecutive failure for a specific user account.
For example, the first failed attempt may have no delay, while the second introduces a small delay, and each following attempt imposes a significantly longer one before the user can try again. This throttling mechanism works in conjunction with the account lockout policy (SRS-088) to provide a layered defense. The delay counter shall be reset to zero upon a successful login. The sequence and duration of these delays shall be configurable by an administrator.
Derived from PRS​
PRS-9F2: Cybersecurity & continuous threat detection