Field techs still use Telnet to the city’s outdoor AP CLI. What preventative change should security mandate?

Disabling Telnet and mandating SSH for encrypted command-line interface (CLI) administration is a critical security enhancement for municipal outdoor access points (APs). Telnet inherently transmits all data, including usernames and passwords, in plaintext over the network. This lack of encryption exposes administrative credentials and session commands to interception by any attacker with network access, potentially leading to unauthorized control over city infrastructure. In contrast, Secure Shell (SSH) employs robust cryptographic protocols to encrypt the entire communication session, ensuring confidentiality, integrity, and authentication of both the administrator and the device. This encryption prevents eavesdropping, man-in-the-middle attacks, and credential compromise, which are especially pertinent in public or semi-public municipal wireless environments. Simply retaining Telnet and adding a longer message-of-the-day (MOTD) banner does not address the fundamental vulnerability; warnings do not prevent attackers from capturing sensitive information. Attempting to move Telnet traffic to UDP is not a recognized security practice and does not provide encryption or improved stealth; it may instead cause operational issues due to protocol incompatibility and lack of reliability. Publishing Telnet credentials openly in a public Wi-Fi portal footer is a gross security misconfiguration that effectively grants administrative access to any user, violating best practices and exposing the network to immediate compromise. The security scope mandates disabling all insecure protocols like Telnet on outdoor APs and enforcing SSH or equivalent encrypted management methods. Operationally, city network teams must conduct thorough audits to verify Telnet is disabled on all devices, confirm SSH is properly configured with strong authentication, and perform test logins to ensure secure remote management functionality. This approach aligns with municipal cybersecurity policies aiming to protect critical infrastructure and maintain public trust.