Typical severity: High. Likelihood of attack: Medium. An adversary tries every possible value for a password until they succeed. A brute force attack, if feasible computationally, will always be successful because it will essentially go through all possible passwords given the alphabet used (lower case letters, upper case letters, numbers, symbols, etc.) and the maximum length of the password.
Implement a password throttling mechanism. This mechanism should take into account both the IP address and the log in name of the user. | Put together a strong password policy and make sure that all user created passwords comply with it. Alternatively automatically generate strong passwords for users. | Passwords need to be recycled to prevent aging, that is every once in a while a new password must be chosen.