I used to use HTTP with no auth, but changed for a bit more security. When I used basic HTTP, here are some of the things I did:
1. Only leave config files on server when something needs to be changed. After device has synced, the file gets taken off public access.
2. Files are encrypted per device settings (I know Grandstream and Cisco support some instance of this, I expect most do).
3. Random path and prefix that I already gave to device in pre-provisioning before sent to customer.
4. Make sure you don't have indexes enabled on your webserver. For example, see
here. If you can type in
myserver.com/blah404_not_valid and see a list of the files and folders, you need to change that.
But, if you want more, you could enable authentication for your devices and have the certificate/username/password already loaded on the device (first provision before you send it out). That will be more specific to your device.
I'm sure other have more suggestions, but the above should help you stay relatively secure. Keeping files off the server, with random paths, and prefixes, should help prevent a brute force scan being successful.
Nick