A company's IDS has detected outbound traffic from a web server over port 389. What is the BEST action to harden the server?

A company's IDS has detected outbound traffic from a web server over port 389. What is the BEST action to harden the server?

• A. Block all outbound traffic
• B. Update the server firewall rules
• C. Move traffic from port 389 to port 637
• D. Disable the web server

Answer: (C)

The best action to harden the server when outbound traffic over port 389 is detected is to move traffic from port 389 to port 637. Port 389 is traditionally used for Lightweight Directory Access Protocol (LDAP), which, if misused or compromised, can pose a security risk. By moving the traffic to port 637, which is used for the LDAP protocol over SSL/TLS (LDAPs), the communication can be encrypted, providing additional security for data in transit. This helps to mitigate risks associated with insecure data transmission and protects sensitive data handled by the web server. Updating the server firewall rules could improve security, but simply modifying firewall settings may not address the underlying issue of unsecured traffic. Blocking all outbound traffic could be too drastic a measure and may disrupt legitimate operations. Disabling the web server would prevent it from serving its purpose entirely and is not a sustainable long-term solution. Adjusting the traffic to a more secure port allows the server to maintain its functionality while enhancing security measures.

The best action to harden the server when outbound traffic over port 389 is detected is to move traffic from port 389 to port 637. Port 389 is traditionally used for Lightweight Directory Access Protocol (LDAP), which, if misused or compromised, can pose a security risk. By moving the traffic to port 637, which is used for the LDAP protocol over SSL/TLS (LDAPs), the communication can be encrypted, providing additional security for data in transit. This helps to mitigate risks associated with insecure data transmission and protects sensitive data handled by the web server.

Updating the server firewall rules could improve security, but simply modifying firewall settings may not address the underlying issue of unsecured traffic. Blocking all outbound traffic could be too drastic a measure and may disrupt legitimate operations. Disabling the web server would prevent it from serving its purpose entirely and is not a sustainable long-term solution. Adjusting the traffic to a more secure port allows the server to maintain its functionality while enhancing security measures.