Which attack mitigation must be in place to prevent an attacker from authenticating to a service using a brute force attack?
Forced password change every 6 months
Use of multifactor authentication for all accounts