A county exposes internet-facing SSH with password authentication and no MFA. How should this be framed?
Select an answer to reveal the explanation.
Short Explanation
Leaving password SSH on the open internet is like a front door with a cheap deadbolt facing the highway. Bots will lean on it all day. Call out exposure, weak auth, and missing MFA as the classic remote-access finding it is.
Full Explanation
Internet-facing SSH with password authentication and no MFA at a county boundary should be framed as a classic remote-access risk class. Password SSH or RDP without strong controls on the public internet invites spray, credential stuffing, and opportunistic compromise of municipal jump paths. Preferring password SSH because keys are harder to rotate reverses modern hardening guidance and ignores MFA as a compensating control. Claiming remote-access findings only apply on internal VLANs invents an exposure exemption that ignores the higher attack surface of internet listeners. Treating lack of MFA as irrelevant because the banner shows a current OpenSSH version confuses patch currency with authentication strength. Exam caveat: version banners do not replace MFA, key-based auth, or network restriction findings. Operational check: document listener exposure, auth methods allowed, MFA status, and recommend key-based auth plus MFA or VPN brokering with admin access removed from direct internet exposure. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services.