As others have said, MFA would be a decent tool but not all attacks are against VPN so it wouldn't always be so useful. As everyone always teaches, security has

As others have said, MFA would be a decent tool but not all attacks are against VPN so it wouldn't always be so useful. As everyone always teaches, security has to be in-depth and the one largely simple control that is very often missing is segmentation of the system. Being able to attack a single department is annoying but unlikely to be considered fatal, however, I think that even savvy IT ops people do not really understand vlans, using switches and air-gaps to keep things apart and really concentrating on any single-points of ingress like Sharepoint sites or whatever although most problems seem to spread across the network layer rather than bridging machines over HTTP. Also, even some simple controls like basic local backup, even to a crappy SAN box in your server room would at least enable you to stick your fingers up at ransomware.