Would you drive in a car without seatbelts? Many
enterprises are taking their corporate well being into dangerous territories
every day by using File Transfer Protocol (FTP) as a data transfer method. FTP
is like a car without seatbelts, offering nothing beyond the basic
transportation of the data.
If an organization uses
FTP to transfer data from one computer to another, it is at real risk of a data
breach and losing critical customer and company information. Why does FTP have
the potential to be so dangerous? FTP is
used extensively in business but often with little oversight. As a result, it
can be taken for granted and become subject to carelessness. For example, one
of your business partners can routinely be downloading some of your critical
business information over FTP in the normal course of business, making it
vulnerable to data breach. Someone in
another department in your organization could bring up an FTP server and gain access
to information not intended for their use.
The worse part of these scenarios is that you may not even be
aware that an intrusion has occurred!
How real is the risk when transporting or storing electronic
data via FTP? The Associated Press recently
obtained detailed schematics of a military holding facility in southern Iraq,
geographical surveys and aerial photographs of two military airfields outside
Baghdad, and plans for a new fuel farm at Bagram Air Base in Afghanistan. The AP was able download this information,
which could have posed a direct threat to U.S.
troops, because it was carelessly posted to FTP file servers by government
agencies and contractors.
Consider some other recent FTP data breaches:
- CardSystems was essentially forced out of business
after 40 million identities were exposed. Amex and Visa stated that they would
no longer do business with the company.
- The personal information of uniformed service
members and their family members were exposed on an FTP server while being
processed by major Department of Defense contractor SAIC. As many as 867,000
individuals may have been affected.
INHERENTLY INSECURE PROTOCOL
Businesses are very conscious of risks to their security--at
the perimeter, inside their networks and within their applications. While
corporate networks, security measures and industry regulations have evolved to
address security risks, and attacker methods continue to grow in
sophistication, most companies still leave themselves vulnerable by relying on
FTP as their primary file transfer method.
FTP contains a number of mechanisms that can be exploited to
compromise security. For example, FTP
allows a client to instruct a server to send files to a third computer. Known as proxy FTP, this feature can instruct
a server to send data to a port of a third computer never intended to receive
the transfer. There is also no provision
for encrypting data during transfer.
Passwords and files are transferred in clear text and can be easily
accessed. The specification also permits
an unlimited number of attempts to enter a password, facilitating password
guessing attacks on the system.
Most computer platforms support the FTP protocol. This means
any computer connected to a TCP/IP based network can manipulate files on another
computer that permits FTP access on that network regardless of the operating
system used. It can also manipulate
files on the server by renaming them or even deleting them. FTP is not a good
method to transfer files when authentication is required or when the data is
sensitive in nature. If a file transfer
is interrupted, the receiver of the transfer has no way to determine if they
have received the entire file.
FTP is an unreliable way
to conduct critical business communications.
Its ease of operation comes with huge risk and cost from data breaches,
attacks by hackers and disgruntled employees, and lack of security compliance.
Companies utilizing FTP protocol for data transfer aren’t always aware of the
amount of unsecured activity that is going on.
There are ways to encrypt FTP transfers, such as FTP over SSH
protocol, which is sometimes called Secure FTP. FTP over SSH tunnels an FTP
session over an SSH connection. While these solutions provide protection of
data as it traverses the Internet, they don’t provide the audit trails and
controls needed today to monitor and analyze all file transfer traffic.
A managed file transfer
(MFT) solution provides companies with total control and visibility of
information-based business processes, with all transfers secure, documented,
auditable, and accountable. An integrated MFT solution enables an organization
to impose security and control over all the enterprise’s information-based
processes.
In addition, MFT
technologies deliver enterprise integration capabilities enabling the
automation of all transferred data.
