Which of the following is the best way to reduce the risk of compromised credentials when an organization allows employees to have remote access?

Multi-factor authentication (MFA) is the most effective control to mitigate the risk of compromised credentials. It requires users to provide two or more verification factors to gain access to a resource. Even if an attacker steals a password (one factor), they cannot gain access without the additional factor(s) (e.g., a code from a mobile app, a fingerprint). This directly addresses the risk of a single compromised credential being used for unauthorized remote access, making it superior to other listed controls for this specific threat.

A. Enable whole disk encryption on remote devices. This protects data at rest on the device's storage but does not prevent an attacker from using stolen credentials to log in and access data.
B. Purchase an endpoint detection and response (EDR) tool. EDR is a detective and responsive control for threats on the endpoint itself; it does not directly prevent the initial authentication with compromised credentials.
D. Deploy single sign-on with complex password requirements. While complex passwords help, they are still a single factor. SSO can increase risk by creating a single point of failure if those credentials are compromised.

1. ISACA, CDPSE Review Manual, 2020, Domain 2: Privacy Architecture, Section 2.5 Identity and Access Management (IAM), states that MFA is a key control for strengthening authentication.

2. National Institute of Standards and Technology (NIST), Special Publication 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management, June 2017, Section 5.1.1 Memorized Secrets, highlights the vulnerabilities of passwords and advocates for multi-factor authenticators.