Remote vendors dial into city systems using only longer passwords. Which control selection most effectively reduces remote-access risk?

Remote access risk for municipal workers is driven by stolen passwords, unmanaged devices, and session hijacking—not merely by password length. Combining network access control (device identity and posture before or during admission) with multi-factor authentication materially changes that risk: something you have or are, plus a checked device state, sits beside something you know.

Lengthening passwords alone still leaves single-factor remote sessions exposed to phishing and credential stuffing. Lobby posters do not enforce technical controls, and leaving VPN open without device checks invites unmanaged endpoints onto sensitive city networks. Disabling VPN concentrator logging reduces noise by destroying forensic signal—operational malpractice, not hardening.

Exam caveat: MFA and NAC are complementary. MFA authenticates the user; NAC evaluates the endpoint’s compliance or identity. Neither replaces encryption of the tunnel, least privilege after admission, or logging of success and failure.

Operational check: require MFA on the VPN or ZTNA portal, gate admission on certificate/agent posture where feasible, alert on repeated failures and impossible travel, and verify that longer-password policy updates did not become the only change ticket closed for a remote-access risk finding.