Public-works engineers still open network gear with Telnet and push firmware over FTP, and cleartext credentials appear in packet captures. Which change best improves administrative protocol security?
Select an answer to reveal the explanation.
Short Explanation
Cleartext admin is like shouting the vault combo across the pump-station floor. Swap Telnet and FTP for SSH and TLS-wrapped transfers so the credentials and commands ride encrypted instead of in the open.
Full Explanation
Administrative access to public-works switches, routers, and similar gear must protect both the credentials and the commands in transit. Telnet and classic FTP send authentication material and session content in cleartext, which is exactly why packet captures on the management path reveal passwords and firmware-transfer details. Replacing Telnet with SSH and replacing FTP with TLS-protected file transfer (for example SFTP/FTPS or HTTPS-based management transfers) encrypts the administrative channel so sniffers on a compromised span port, poorly segmented management VLAN, or rogue tap cannot trivially harvest engineer credentials or alter firmware in flight. That protocol upgrade is the direct fix for cleartext administration risk on municipal network infrastructure.
Moving the Telnet management VLAN to a different subnet number only relocates the same cleartext problem; isolation helps, but it does not encrypt the protocol. Blocking ICMP may hinder some discovery techniques, yet it does nothing to protect Telnet or FTP sessions that still run unencrypted once an attacker is on-path. Lengthening the Telnet password while leaving sessions unencrypted raises brute-force cost slightly but still exposes the password and session contents to passive capture—complexity without confidentiality.
Exam caveat: encrypting admin protocols complements, but does not replace, management-plane ACLs, jump hosts, MFA where supported, and out-of-band management design. Also remember that 'management VLAN' alone is not encryption.
Operational check: confirm SSH (and SFTP/HTTPS) is the only allowed remote admin path on public-works devices, disable Telnet/FTP listeners, validate certificate or host-key handling, and spot-check captures or logs to ensure no residual cleartext admin traffic remains on the municipal management segments.