A civic application's FTP service allows anonymous listing during approved testing. How should the tester handle that result?
Select an answer to reveal the explanation.
Short Explanation
Anonymous listing is a unlocked filing cabinet in the lobby — definitely a finding. Still, RoE decides how much you flip through and what you copy. Least impact beats souvenir hunting.
Full Explanation
Anonymous FTP list or read access is a classic service misconfiguration and information-disclosure finding. Testers should document it clearly while handling any retrieved data under RoE, privacy, and least-impact principles. Legacy status does not remove reportability. Anonymous access never authorizes attacking unrelated organizations or unrestricted public redistribution of client data.