Posts Tagged ad-hoc file transfer

Hacking and File Transfers: What You Need to Know

Posted by on Tuesday, 4 December, 2012

In the battle to secure information, it helps to know a little bit about how it can be compromised. Using FTP is one way to expose critical vulnerabilities that can allow credentials to be hacked.  However, these holes in security can also be easily closed if you know how.

How Hackers Discover Vulnerabilities

Here’s how hackers could access sensitive data sent via FTP.  With the use of a “sniffing” tool, an attacker could intercept and log any data traveling across the network. This log can then be analyzed to look at the content that was sent across specific TCP ports like FTP (port 21), as well as the user ID and passwords used to log in to the FTP servers that may have been sent as clear text.

managed file transfer, secure file transferStart with Networks, Routers, and Firewalls

To prevent this kind of hacking, the wired network can be secured by first making sure network ports are not available for public access, and then by separating network segments for sensitive servers and workstations.

However, many companies also have wireless networks where hackers just need reasonable proximity to the Wi-Fi signal, such as in an adjacent office or parking lot.  Therefore, it is critical to secure wireless routers with WPA or WPA2 encryption options, rather than WEP encryption, which is no longer considered effective protection against hackers.

Once networks are secured, the next most effective tactic against hackers is to block all FTP traffic at the firewall. Then, for permitted file transfers, allow only secure encryption protocols such as SFTP, FTPS, HTTPS, PGP, or GPG for file exchanges in and out of the network. These security restrictions will deter most hackers.

Security Measures Can Be Challenging

Implementing these security measures is important, but it doesn’t come without some challenges.  The IT staff will have to handle more complicated secure file transfer management processes, and users may be inconvenienced as files are transferred to people and organizations that need them.  As a result, users may look for a workaround for sending and receiving files to avoid being slowed down by the IT staff.  Popular alternatives users may try include email attachments or browser-based cloud services such as Dropbox that present a new vector of vulnerability as these options may not meet necessary security standards.

MFT Minimizes Hassle, Solves Security Vulnerabilities

There is a solution, however, that can provide not only the highest security for file transfers, but also create fewer hassles for both the IT department and the general employee.

Managed File Transfer (MFT) solutions increase data file security implementations and simplify the entire file management process by providing the tools for easily creating and managing all of the unique encryption keys for the company’s various trading partners.  Access controls can be set up for authorizing each employee’s file exchange requirements. MFT also provides a detailed log of all transactions so that any required audits may be easily fulfilled.

Some MFT vendors also provide intuitive and convenient email encryption solutions that can integrate with existing corporate email clients such as Outlook. This reduces the temptation for employees to use workaround tools that may bypass the security restrictions that have been put in place to prevent hacking of sensitive data.

Keeping data secure is an ongoing mandate that will only become more critical as industries move toward paperless environments.  Adopting a managed file transfer solution is one of the best ways to strengthen your file transfer processes and security as the pressure and liability risks continue to grow.

photo credit: kryptyk via photopin cc
 
 

Daniel Cheney

Daniel has been the IT Director at a healthcare company for the last 12 years and a longtime beneficiary of GoAnywhere Director and the IBM i platform. He is also a technical analyst and writer for various technical and social media projects with Humanized Communications.

More Posts - Website - Twitter - Facebook - LinkedIn - Google Plus - YouTube

GoAnywhere Secure Mail Now Works with Outlook 2010

Posted by on Friday, 3 August, 2012

With the latest release of GoAnywhere Services 2.8.0, the development team included a plug-in that integrates Secure Mail with Outlook 2010.  This is great news for both the IT staff and everyone else in the organization who finds themselves needing to send files via email.

Whether we realize it or not, the simple act of emailing a file as an attachment can pose a significant security vulnerability, especially for organizations governed by strict compliance regulations.  Learn more in the previous post “Ad-Hoc File Transfers Present Challenges, Vulnerabilities.”

For those unfamiliar with the GoAnywhere Services Secure Mail module, it allows users to send files securely by generating a unique, encrypted link that is emailed to the recipient.  The receiver can then click on the link to view or download the files via HTTPS.

The benefit for employees is that they can now send any files, regardless of size, through their Outlook 2010 email client, or they can use the web form that comes with the Secure Mail module.

Even better for the IT staff is the ability Secure Mail provides to track these ad-hoc file transfers and maintain thorough audit trails required by compliance auditors.  And, by implementing a secure mail solution throughout the organization, the IT department regains control over protecting sensitive data while eliminating the need for employees to use any of the free FTP tools they may have downloaded to their desktops or the various cloud applications popping up each month.

GoAnywhere Services Secure Mail WebinarIf you’re curious about how GoAnywhere Secure Mail, looks, feels, and operates, check out our free 30-minute webinar on Wednesday, August 15, where Chief Architect Bob Luebbe will demonstrate how easy it is for even the least technically inclined person in your company to use it to send ad-hoc files.  Register to view recorded webinar here.

 

Susan Baird

Susan is the Marketing Manager at Linoma Software, helping promote our secure file transfer and encryption solutions. Her specialty is content creation and social media marketing.

More Posts - Website - Twitter - Facebook - LinkedIn - Pinterest - Google Plus

Data Breach Remains a Hot Topic for Media

Posted by on Monday, 19 March, 2012

During the past few years, the media has highlighted a variety of examples of the loss of private information by large companies either by theft or misuse.

One of the reasons for the increased media attention is the renewed focus on establishing and enforcing data breach notification laws which apply to companies that own, lease or store private, personally identifiable information. If that data is exposed to unauthorized use either by accident, cyber attack, employee misconduct, or other causes, most states require companies responsible for protecting that data to announce the data breach and individually notify everyone affected. Some states require that credit agencies are also notified.

data breach, managed file transferFor clarification, private data means any information that can be used to identify an individual, including sensitive information such as a credit card number, social security number, or health related data.

There are a few exceptions to having to report the data breach. If the compromised files were encrypted while in transit across the Internet or stored on stolen backup tapes, for example, it is unlikely that the files could be unencrypted, so the individuals’ privacy isn’t as likely to be compromised.

A company that finds itself dealing with a data breach learns quickly that the process is not just embarrassing and costly (sending notifications, providing free credit reports, etc.), it can also damage the company’s hard-earned reputation resulting in the loss of customers. The point is that companies are responsible – and legally liable — for the information that is in their hands.

Securing File Transfers

Most companies use FTP (file transfer protocol) to send data files back and forth to their trading partners, vendors, remote employees, etc. Most often, FTP is used to send files that are too large to email.

However, file transfers like these are captured and compromised by data thieves on the Internet every day — unless security procedures have been put into place to safeguard the files’ data.

Companies need to implement procedures that secure both an in-motion process (files in transit over the Internet) and an at-rest process (files stored on servers or backup tapes). SFTP and FTPS protocols both secure the file while in motion by encrypting the communication link between two systems during the file transfer. PGP encrypts the file itself, protecting it while at rest on the server or backup tapes.

When addressing the challenge of sending ad-hoc files that are too big to email, finding a managed file transfer solution that includes a secure mail feature can mean the difference between an accidental data breach and a successfully delivered file.

Implementing these security procedures is a significant step organizations can take to greatly reduce their risk of data breach, and therefore their exposure to the financial liability and the loss of confidence of their customers and trading partners.

 

Daniel Cheney

Daniel has been the IT Director at a healthcare company for the last 12 years and a longtime beneficiary of GoAnywhere Director and the IBM i platform. He is also a technical analyst and writer for various technical and social media projects with Humanized Communications.

More Posts - Website - Twitter - Facebook - LinkedIn - Google Plus - YouTube

Ad-Hoc File Transfers Present Challenges, Vulnerabilities

Posted by on Thursday, 1 March, 2012

Regardless of industry or job title, most employees who sit at a computer screen all day have, at one time or another, needed to email a file that was too big to send.  For most people outside of IT, that posed a significant obstacle.

Take Betsy, for example. How could Betsy in Marketing send the CEO’s requests for changes to the annual report back to the ad agency if the file was too large to attach to an email?   Fax it, maybe?  So old school!

secure mail, ad-hoc file transferBetsy is eager to do a good job and meet expectations, and hates depending on someone else to help her do something she perceives should be relatively easy to do — like send a file as an email attachment.  Therefore, because her boyfriend told her something about FTP-something, she uses a search engine and finds a host of FTP tools she can download for free that promise to solve her problem quickly and easily.  Score!

Free FTP tools, browser apps, and cloud-based storage, oh my!

This scenario is replicated in thousands of companies every day.  Employees download FTP tools or use FTP features that “come with” their browser, and they rejoiced believing that their file transfer problems were solved.   Others created accounts on cloud-based file storage systems where they uploaded files and then sent an invitation to the recipient to download the file using a specific link.

Unfortunately, while a free FTP tool downloaded from the Internet might solve an immediate need, it often creates a host of other problems, and many of them go unnoticed because IT administrators are unaware that this is happening.

Here are just a few of the challenges for the IT staff:

  • Who has what tool installed on which machine?
  • Who provides support for these tools if there’s a problem with a file transfer?
  • How are the file transfers secured to prevent data breach?
  • Who is monitoring what data is being transferred, by whom, to which recipients, and for what purpose?
  • How is the receipt of the documents confirmed?
  • How will compliance auditors view this approach to ad-hoc file transfers?

There’s no easy solution — or is there?

Company policies could dictate a variety of solutions.  They could block the download of any apps to individual desktops at work, and/or require people who need to do ad-hoc file transfers to register the tool and the relevant login data with the IT department for approval.  They could require that anyone who needed to send a large file make a formal request to the IT department and wait for someone there to send it via the company’s official FTP software or managed file transfer solution. They could require all staff to sit through mandatory training to deter them from continuing this practice.

A more effective approach might be implementing a secure mail tool.  A trustworthy secure mail system will keep the files that need to be transferred stored securely within the organization’s network, and will allow authorized users to email a unique link to a trading partner that they would use to access and download the files via an HTTPS secure channel.

Most of the cloud-based file storage systems provide a similar approach, allowing users to store their files and then invite others to view or download them using a link.

There are critical differences, though, between a secure mail system and the cloud-based apps.  Most importantly, secure mail gives control back to an organization’s IT administrators so they can track file transfers and maintain audit logs, both of which are required by most compliance regulations such as HIPAA, PCI DSS, SOX and GLBA.  A secure mail system that is controlled by the IT staff can ensure that file transfer policies are followed, and can include additional security features such as requiring additional password protection, applying link expiration dates, and other features.

Bottom line

Most organizations want efficient workflows, employees who feel empowered to do what it takes to meet expectations, and assurances that the data they store and transfer is insulated from external threats.  A secure mail ad-hoc file transfer solution seems like a smart way to accomplish all of those goals.

GoAnywhere Services just released a new Secure Mail module, so check it out.

Susan Baird

Susan is the Marketing Manager at Linoma Software, helping promote our secure file transfer and encryption solutions. Her specialty is content creation and social media marketing.

More Posts - Website - Twitter - Facebook - LinkedIn - Pinterest - Google Plus