Corrrection - its optional now. From web.config

 passwordAttemptThreshold="int"             The number of failed password attempts, or failed password answer attempts that are allowed before locking out a user?s account (where "int" equals the desired number).

To enable this just look for this in web.config and add the setting to the DNNSQLMembershipProvider options.

Cool didn't realise that before...

On a slightly different topic, but still related to security, i know that you can set up DNN to send a verification code via email to users when they register, but is tehre any modules or plugins that will allow you to use one of those "verification pictures" with the numbers and letters that the user needs to type in to confirm their registration?

There sure is!

http://dnn.tiendaboliviana.com/web/Default.aspx?tabid=78