There's no shortage of #cybersecurity talent in the industry. However, like any domain where people over-specialize because of market conditions, you end up with questions like this one where people don't understand how application or session layer protocols actually work, and how a "security protocol" actually works.
Email is an outdated messaging protocol, but the transport layer is just as secure as #HTTPS when using #TLS. Most modern MTAs default to using #SMTP over TLS, or use opportunistic encryption with #STARTTLS. Both the client and server are usually configured to drop insecure connections before user authentication happens.
The only correct answer here is #SSL, which was deprecated more than nine years ago due to limitations and vulnerabilities in its supported ciphers. SMTP is not a security protocol, yet 68% of respondents apparently think it is. That's a problem.
No one should be expected to know everything, and not all security people focus on networking, encryption, or handshake protocols. However, if you don't want to be the next breach-in-the-news, please ensure your staff at least understands the basic controls used or needed for the systems you've hired them to protect!
https://www.linkedin.com/posts/the-cyber-security-hub_activity-7132819961705566209-UNFm
