Network staff still use cleartext Telnet to manage closet routers for a municipal campus. What is the most appropriate remediation?

Cleartext Telnet to closet routers exposes administrative credentials and session content anywhere along the municipal campus path—including hostile or compromised segments. The appropriate remediation is to replace Telnet with secure management protocols such as SSH, and to use IPsec or TLS-protected channels where the management architecture requires them, so device administration is confidential and integrity-protected. Secure protocol selection for network device management is a foundational Communication and Network Security control for city infrastructure.

Changing only the Telnet listening port is obscurity; passwords and keystrokes remain cleartext to anyone who finds the service. Moving Telnet onto UDP does not add encryption and may merely evade tooling without reducing exposure. Posting passwords on closet doors maximizes physical and insider credential theft under the label of break-glass speed.

Exam caveat: CISSP expects replacement of insecure cleartext management protocols with encrypted alternatives; port changes, transport tricks, and posted credentials are classic distractors that do not remediate interception risk.

Operational check: disable Telnet and cleartext HTTP management where possible; enforce SSH with strong authentication (keys and centralized AAA); restrict management to dedicated VRFs or out-of-band networks; log administrative sessions; rotate credentials after migration; scan campus gear for lingering cleartext listeners and remediate exceptions with named risk owners.