An attacker placed a macro in a word-processing file that was opened by a user in an organization’s legal department. The attacker used this method to obtain access to confidential financial data. Which two recommendations should a security expert make to mitigate this type of attack? (Choose two.)