Req 2.2.3 focuses on securing insecure services. Which approach reflects this requirement?

• A. Continue using Telnet for admin access
• B. Disable all security measures
• C. Use unencrypted FTP for file transfers
• D. Use secured technologies such as SSH, TLS or IPSec to protect insecure services

Answer: (D)

Securing insecure services means replacing or protecting protocols that send data in the clear with encrypted, authenticated alternatives. In practice, that means using secure technologies such as SSH for remote administration, TLS to encrypt communications for services that support it, or IPSec to protect IP traffic. These options prevent eavesdropping, tampering, and credential theft by ensuring data is encrypted in transit and that endpoints can verify each other.

The best choice reflects this approach by promoting secure technologies to shield services that would otherwise transmit sensitive information unprotected. In contrast, continuing to use insecure protocols (like Telnet or unencrypted FTP) or removing security measures altogether would leave cardholder data exposed and fail to meet the requirement.