I'm doing a security analysis of a network for a university project. The servers use the basic autentication of iis, integrated with ssl. I'm now considering the possibility of a bruteforce attack. I know that good policy require complex passwords, change passwords every few days, etc. .. but have a system that, after 5 wrong attempts (for example) block the account for 1 hour, it helps to have a greater security against these attacks. What I ask is if there is that kind of protection.