During a network hardening review, a security analyst discovers that all edge routers are managed remotely using Telnet over the production data network. Administrators authenticate with shared local credentials, and configuration changes are pushed daily. Which single change most directly reduces the risk of credential and configuration exposure during remote management sessions?