If the pages being protected are not required for the functionality of
the web application they should be removed, otherwise, it is
recommended that basic and basic realm authentication are not used to
protect against pages requiring authentication.

If NTLM based basic
authentication must be used, then default server and domain accounts
such as `administrator` and `root` should be disabled, as these will
undoubtedly be the first accounts to be targeted in any such attack.
Additionally, the webserver should not be joined to any corporate
domain where usernames are readily available (such as from email
addresses). If the pages are required, and it is possible to remove
the basic authentication, then a stronger and more resilient
form-based authentication mechanism should be implemented to protect
the affected pages.