How to Reduce The Most Common File Transfer Security Risks
Individuals are constantly transferring files to their colleagues and trading partners, whether those files are Word documents, reports and spreadsheets, or shipping notices and acknowledgements. Most of the time, people simply assume these file transfers are safe.
But in reality, hidden risks abound.
Email transfers can use unsecured plain text. Files can be unencrypted. Or a file transfer server can be exposed to the Internet. And if your business-critical data transfers are compromised, you can suffer expensive downtime and expose yourself to serious security breaches, and other business risks.
With that in mind, here are some of the key risks you'll encounter and what you can do about them.
1. Plain-Text FTP
FTP is not a secure method of transferring files. While it may be sufficient for sending and receiving non-sensitive files on your own internal network, it provides no encryption and will not safeguard files sent over the Internet. Worse, not only are your files left in the clear, but so are your user credentials, which means both files and sign-on information can be stolen in transit.
The Solution: FTPS & SFTP
Use FTPS (FTP with TLS encryption) or SFTP (FTP with SSH encryption) to encrypt your files and user credentials for files in transit. You can also use a file transfer solution that incorporates added encryption, such as OpenPGP, to FTP file transfers.
2. Unsecured Plain-Text Emails
Most modern email servers support TLS encryption to protect your files during transit. But not all do — and if they don't, your files won't be safe from prying eyes.
The Solution: Encrypted Email Servers
Use only email servers that support the latest TLS encryption. Certain file transfer tools do offer a secure email mechanism.
3. Servers Exposed to the Network in the DMZ
One core security tenant is isolating your file transfer servers from external networks and threats. For internal transfers, from one database or application to another inside your organization, you can contain all transfers within your secured network. But sharing files with external trading partners is a different story. Some B2B file exchange protocols, such as AS2, require you to expose a server across the network. The contents of an AS2 message are encrypted and signed, but because AS2 is an HTTP service, you may have to expose an FTP server for your trading partner to connect to so they can exchange files. And in doing so, you open up your server to risks. The other option is to locate your server inside your DMZ, which is less secure than having it on your internal network.
The Solution: File Encryption or Reverse Proxy Gateway
When using protocols such as AS2, mitigate the risks from exposing your server by implementing rules in your firewalls that only allow connections from specific IP addresses. You can then safely permit specified whitelisted trading partners to connect. If you leave your server inside the DMZ, then encrypt files there at rest. Then, if someone penetrates the DMZ, they won't be able to view the contents of your files. Alternatively, keep your server in your internal network and use a reverse proxy cloud gateway in the DMZ to forward the connection to that server.
4. Unsecured Scripting
Many system administrators today use scripting to automate file transfer processes such as FTP uploads and downloads. However, such FTP file transfer scripts will likely not include basic security such as encryption. Often, scripts contain passwords in plain text, which can compromise their security.
The Solution: Managed File Transfer
A managed file transfer solution gives you a full range of security features to reduce risk, including more secure multi-factor authentication centralized through the Active Directory and encryption. Security is just one of many reasons why MFT is superior to scripting for file transfer automation.
5. Unsecured Open-Source Clients
Often, SFTP clients are available for free as part of an open-source tool. These SFTP tools offer a cheap way to exchange files, allowing you to perform basic file transfer with encryption and user authentication as well as perform unlimited file transfers per server connection and control port usage. However, these free tools typically lack enterprise-level security features, such as integrated key and security managers or folder-level permissions that can protect data and meet certain regulatory requirements. And because free tools tend to be updated infrequently or not at all, they leave users susceptible to cyberattacks if they neglect to patch vulnerabilities themselves.
The Solution: Enterprise-Grade SFTP — Yes, It Does Exist
Not all SFTP solutions are created equal. Ensure you select a managed file transfer solution that provides a full set of feature-rich enterprise-class SFTP client capabilities. It should include enterprise-grade security features such as key-based, password, and dual-factor authentication; integrated security managers; and folder-level permissions.
Learn more about enterprise-class SFTP.
6. Shared Private Keys
Even if you have an SFTP server and forced public-key authentication, your file transfers still may not be completely secure. If private keys are accessible to anyone in your organization, your file transfer will be no better protected than if you required no public key authentication.
The Solution: Secure Certificate Management
Set up processes that force people to store private keys in a secure manner. Ensure keys are not shared outside the organization, or to unauthorized users within your organization. In addition, consider a solution that can handle secure certificate management _for you_, one that simplifies and centralizes the process of generating, managing, and storing certificates and limits access only to authorized users.
7. Insecure APIs
Sometimes, a file transfer solution may use unsecured APIs. In this case, data is broadly accessible and unsecured, and the many other security layers you've put in place can become compromised.
The Solution: Require Authentication for API Access
Check that your APIs are secure and only accessible to those with sufficient permissions. Ensure the same rigorous authentication is required for API access in your chosen file transfer tool that is required for broader admin access.
8. Corrupted Server System
If you have one server that contains all your files and performs all of your file transfers, you have a potential single point of failure. If disk drive fails and becomes unusable, you may lose your data, posing a threat to your processes.
The Solution: Regular Data Backups and Sync
Perform regular backups and test your ability to recover the system if something goes wrong. Additionally, ensure your file transfer solution provides streamlined mechanisms to sync your data to data stores you already use with your business.
9. The Person Who Handles File Transfers Leaves Your Organization
If the person who set up your file transfer solution leaves and no one else understands the flow of your transfers, those processes could become unusable. This becomes especially problematic if you have a setup with several ad hoc file transfer tools mixed with a mess of scripts.
The Solution: Documented Processes and Supported, Centralized Solutions
Fully document your processes so you can easily transfer the necessary knowledge to someone else. In addition, select a centralized system that is well supported, intuitive to use and easy to maintain — ideally with minimal coding required.
10. Keeping the Lights On
One of the biggest risks for IT managers is simply keeping the lights on. When something goes wrong, they may have difficulty figuring out how to troubleshoot the issue.
The Solution: Select a File Transfer Tool with Excellent Support
Make sure your solution is supported well enough that when something goes wrong, you can get the assistance you need to quickly resolve the issue.
Managed File Transfer: How to Simplify Integration and Reduce Risks
Companies are increasingly turning to managed file transfer to centralize, secure, and automate critical file transfers and file-based integration. Download our guide to learn more.
