Model Response: Risk 1: FTP transmits all file contents in plaintext — customer PII (names, emails, account numbers) can be captured by anyone who intercepts the network traffic. Risk 2: FTP credentials (username/password) are also sent in plaintext, allowing an attacker to steal login credentials and gain persistent unauthorized access to the staging server.

SFTP is the recommended replacement. SFTP runs over an SSH tunnel, encrypting both the authentication credentials and the file data in transit. Unlike FTP, SFTP supports key-based authentication (eliminating password transmission entirely) and verifies data integrity through cryptographic hashing.

Model Response: Root-level Telnet is especially dangerous because an attacker who intercepts the session captures root credentials — granting them complete, unrestricted control over 40 production servers. With root access, the attacker can modify configurations, steal data, install backdoors, delete logs, and take servers offline. The plaintext transmission of the most privileged credentials creates maximum blast radius from a single interception.

SSH feature 1: Full session encryption — all commands, output, and credentials are encrypted end-to-end, preventing interception even on compromised networks. SSH feature 2: Key-based authentication — SSH supports public/private key pairs that eliminate password transmission entirely. Even if the network is monitored, there is no password to capture.

Model Response: Security risk: Expired certificates break the trust verification chain. Clients can no longer confirm that they are communicating with the real NovaTech server. An attacker could perform a MitM attack by presenting their own certificate — and if clients have been conditioned to click through warnings (because the real cert is expired), they may accept the attacker’s certificate without suspicion. Additionally, automated systems that enforce certificate validation will refuse to connect, creating availability failures.

Practice 1: Implement automated certificate renewal using ACME protocol (e.g., Let’s Encrypt or similar CA) so certificates renew before expiration without manual intervention. Practice 2: Deploy certificate monitoring that alerts the security team 30 and 7 days before any certificate in the inventory expires, with an escalation path if renewal does not occur.