What is the recommended mitigation for unencrypted FTP exposing credentials?

What is the recommended mitigation for unencrypted FTP exposing credentials?

• A. Use SSH-based File Transfer (SFTP/FTPS)
• B. Increase encryption strength of FTP
• C. Use Telnet for legacy compatibility
• D. Change default port

Answer: (A)

Transmitting credentials over plain FTP means they travel in clear text and can be captured by anyone monitoring the network. The best way to mitigate this is to switch to a secure file transfer method that encrypts the session, so both authentication and data are protected in transit. Using SSH-based File Transfer, such as SFTP or FTPS, provides that encryption: SFTP uses the SSH protocol to encrypt the entire transfer, while FTPS wraps FTP in TLS to secure the connection. Either option prevents credentials from being exposed to eavesdroppers and tampering. Other options don’t address the underlying issue. Simply increasing the encryption strength of FTP isn’t effective because plain FTP itself isn’t encrypted, so stronger encryption on top wouldn’t hijack the plaintext transmission. Telnet is also unencrypted and would expose credentials, not protect them. Changing the default port likewise does not secure the data being sent over the network.

Transmitting credentials over plain FTP means they travel in clear text and can be captured by anyone monitoring the network. The best way to mitigate this is to switch to a secure file transfer method that encrypts the session, so both authentication and data are protected in transit. Using SSH-based File Transfer, such as SFTP or FTPS, provides that encryption: SFTP uses the SSH protocol to encrypt the entire transfer, while FTPS wraps FTP in TLS to secure the connection. Either option prevents credentials from being exposed to eavesdroppers and tampering.

Other options don’t address the underlying issue. Simply increasing the encryption strength of FTP isn’t effective because plain FTP itself isn’t encrypted, so stronger encryption on top wouldn’t hijack the plaintext transmission. Telnet is also unencrypted and would expose credentials, not protect them. Changing the default port likewise does not secure the data being sent over the network.