A county exposes internet-facing SSH with password authentication and no MFA. How should this be framed?
Select an answer to reveal the explanation.
Short Explanation
Leaving password SSH on the open internet is like a front door with a cheap deadbolt facing the highway. Bots will lean on it all day. Call out exposure, weak auth, and missing MFA as the classic remote-access finding it is.
Full Explanation
Common remote administration services become high-value targets when reachable from the internet with password-only authentication. Absent MFA, rate controls, or key-based restrictions, credential attacks and opportunistic scanning are more likely to succeed. Assessments should document exposure, authentication method, and recommended hardening such as VPN fronts, key auth, and MFA. Version currency alone does not neutralize weak access design.