During a security control evaluation, an analyst finds that the company's remote-access VPN authenticates users with only a username and password. Credential-stuffing attacks against the VPN portal have already led to two unauthorized logins in the past quarter. Which recommendation most directly closes the diagnosed control gap?