1. Require strong passwords or PINs.
  2. Disable default passwords immediately.
  3. Lock accounts after repeated failed attempts.