Let's say you have a system that you want to integrate with Salesforce. You create a new user for the system, set up a trusted ip range, make the profile an API-only user, and then give the username and password to the system. If the worst were to happen and the credentials were compromised, it seems like there is a good level of security in place. The attacker wouldn't be able to login to Salesforce through the ui since the credentials are api-only, and they also wouldn't be able to login through the api since they are at a different ip address and their login attempts would be denied with a error message saying that they need a security token.
Are there other precautions involving the login process that should be taken to ensure Salesfore stays secure?