Also, of course, only allowing remote access from a controlled list of source IP addresses.