Diametric Security Concern

Security is mostly about preventing unwanted access to resources, often another users information, but there is another goal of securing a system against attack. A denial of service attack is designed not to access resources without permission, but to deny access to those users who have permission. These two goals are often contradictory. Imagine you're concerned that a bad actor will gain access to users accounts by brute forcing passwords. You could add a condition which stops responding to login request to a particular account after thirty unsuccessful login attempts have been made. A bad actor could then issue thirty wrong guesses against any account and lock the legitimate user out. Designing a security system such that it blocks bad actors while preventing those same bad actors from intentionally blocking valid users is a careful balancing act.