Question 35

SSH tunneling is the most appropriate compensating control for protecting sensitive data in transit.

Using SSH tunneling allows the company to create a secure channel over the existing FTP protocol, effectively encrypting the sensitive financial data being transmitted to the third party.

A) Tether connection

A tether connection primarily refers to sharing an internet connection from one device to another and does not provide any encryption or security measures for data in transit. Therefore, it is not suitable for protecting sensitive financial data.

B) SSH tunneling

SSH tunneling effectively encrypts data transferred between hosts, making it a strong compensating control for the legacy FTP server. It allows the company to securely transmit sensitive financial data without needing to upgrade the legacy system to support SFTP.

C) Patch installation

While patch installation is important for fixing vulnerabilities in software, it does not directly address the issue of securing data in transit. Since the legacy FTP server cannot support SFTP, merely installing patches does not provide the necessary encryption for sensitive data being transmitted.

D) Full disk encryption

Full disk encryption secures data at rest on a storage device but does not protect data during transmission. As the issue pertains to securing financial data in transit via the FTP server, this option fails to meet the specific requirement for securing data while it is being sent.

Conclusion

SSH tunneling is the most effective solution for securely transmitting sensitive financial data over a legacy FTP server, as it provides the necessary encryption that the existing system lacks. All other options fail to adequately protect the data during transmission, either by not addressing the issue of in-transit security or by focusing on aspects unrelated to data transmission.