What are the steps to prevent the brute force Facebook attack?

Regarding the brute force Facebook attack, Despite the fact that Facebook locks accounts after many tries as the other answers said, you should keep in mind that "replacing your IP with a new one" is not as trivial as you make it sound. Most internet service providers allow you to release your IP lease and get a new IP address, but the attacker will usually receive one from a small pool of a few hundred to a few thousand IP addresses.

Sure, there are proxy servers and the TOR network, but these will only supply the attacker with a few hundred additional IPs. When the attacker has access to a botnet, they could use each bot of the botnet to request as much IP as they can get from their respective ISPs (good luck doing this without the user noticing anything). But large botnets are expensive. Spoofing the IP address won't work either, because IP spoofing isn't easy to do when you want to not just send packets but also receive the responses. When you want to brute-force a HTTP login, you will need to perform a TCP handshake first, which requires being able to receive responses. Also you certainly want to parse the response to know if you were successful. And even when you could theoretically use all ~4 Billion IPv4 addresses the internet has to offer, multiplying your tires with 4 billion only gives you enough tries to bruteforce passwords with 4-6 additional characters (depending on how many different characters the password contains). And last but not least, the main problem with brute-forcing via network is the bandwidth you have available which greatly limits your attempts per seconds compared with what you can do when you brute-force hashes locally. When you use a 8 character password with mixed case, numbers and special characters and no dictionary relation (common recommendation), brute-forcing via network is completely infeasible, even when the system uses no flood protection whatsoever.