* Importance of Secure Protocols for Web Server Management:
* Web servers handle sensitive data, including user credentials, financial information, and confidential communications.
* Using secure protocols like HTTPS, SFTP, and TLS-encrypted SMTP ensures data is encrypted and protected from cyber threats.
* Risks of Clear-Text Protocols (HTTP & FTP):
* HTTP (Hypertext Transfer Protocol) and FTP (File Transfer Protocol) transmit data in plaintext, making them vulnerable to man-in-the-middle (MITM) attacks, packet sniffing, and unauthorized access.
* SFTP (Secure File Transfer Protocol) and HTTPS (Hypertext Transfer Protocol Secure) encrypt data, mitigating these risks.
* Why Other Options Are Incorrect:
* A. The file transfer protocol (FTP) should always be enabled - Incorrect.
* FTP is not secure, and enabling it can expose the server to unauthorized file access and cyberattacks.
* B. The simple mail transfer protocol (SMTP) should be operating under the most privileged accounts - Incorrect.
* SMTP should operate with minimal privileges to reduce security risks in case of a breach.
* C. The number of ports and protocols allowed to access the web server should be maximized
- Incorrect.
* Minimizing open ports and protocols reduces the attack surface and limits unauthorized access.
* IIA's Perspective on IT Security and Web Server Management:
* IIA Standard 2110 - Governance requires organizations to establish secure IT practices, including encryption and secure protocols.
* IIA GTAG (Global Technology Audit Guide) on IT Risks emphasizes minimizing security vulnerabilities by using encrypted communication.
* ISO 27001 Security Standard recommends secure transmission protocols for protecting sensitive data.
IIA References:
* IIA Standard 2110 - IT Security and Governance
* IIA GTAG - IT Risks and Secure Web Server Management
* ISO 27001 Security Standard - Data Encryption and Secure Transmission Thus, the correct and verified answer is D. Secure protocols for confidential pages should be used instead of clear-text protocols such as HTTP or FTP.