The Chief Executive Officer at a bank recently saw a news report about a high-profile cybercrime where a remote-access tool that the bank uses for support was also used in this crime. The report state

Enabling multifactor authentication (MFA) adds a second layer of security beyond just a password, making it significantly harder for attackers to gain access even if they brute-force a password. MFA requires something the user knows (password) and something the user has (e.g., phone, authenticator app) or something the user is (biometrics).

Limiting remote access to destinations inside the corporate network might reduce the attack surface but does not directly prevent brute-force attacks if access is still available to the vulnerable tool.

Blocking logins from foreign countries could be a security measure, but it is not as comprehensive or direct a mitigation against brute-force attacks as MFA or account lockouts.

Configuring a replacement remote-access tool does not inherently solve the brute-force problem if the new tool is not configured with strong authentication mechanisms.

Purchasing a password manager for users helps users create and store strong passwords but does not prevent a brute-force attack from occurring on the system itself if the password manager is not integrated with strong authentication.

Enforcing account lockouts after a small number of bad password attempts directly counters brute-force attacks by temporarily disabling the account, making it impractical for attackers to guess passwords repeatedly. This prevents continuous password guessing and secures the account from unauthorized access.