RPTUSER account was replaced with individual named accounts for each analyst - Each account was mapped to the WL_REPORTING workload - Connection from non-approved IP addresses was blocked via CONNECT restrictions