For my SDEV 350 Database Security class, we were discussing the proper use and protection of passwords. Other topics included physical security, firewalls and database software protection. What are 2 best practices on the mentioned topics? I would need examples and additional details to further emphasizing their importance. An example would be showing how weak passwords could be guessed quicker, and how the use of database locking after multiple failed login attempts support security.

**I do not have a reference to provide. It must come from outside journal articles/readings which is why I am struggling a bit.