Implement strict settings on servers access control containing confidential data (minimum length of passwords, frequency of change, not reuse, closing accounts after failed multiple attempts , tests of non trivial password, etc..).