There are some simple ones missing here:

* Automatic blocking for repeated login attempts
* Multifactor authentication
* Firewall
* Checking logs etc...