Companies plug FTP holes with secure FTP servers

For Columbus, Ohio-based Grange Mutual Casualty Group, transferring sensitive documents is part of a daily routine for its agents out in the field. Brian Smith, a system administrator at Grange is in the middle of the roll out phase of a secure FTP server to handle file transfer for agents and third-party business partners.

Smith said it is important for Grange to allow agents to easily transfer medical data and other sensitive customer information to increase efficiency and speed the company's processes. However, locking down that sensitive data is the company's highest priority, he said.

"We're trying to avoid transferring data though email, because any number of things can happen with something as simple as mistyping an email address," Smith said. "We're able to have an entire ftp environment encapsulated in its own world, but it also has a lot of functionality and it can be tied into Active Directory."

Grange chose San Antonio, Texas-based GlobalSCAPE Inc., for secure FTP. GlobalSCAPE, a vendor with roots in the consumer market with its CuteFTP product, a zip utility used to download music and other files, has been trying to compete for a larger share of the enterprise business. It faces competition from Dublin, Ohio-based Sterling Commerce and Scottsdale, Arizona-based Axway Inc., which have the most market share among enterprises for secure FTP. Meanwhile, Lexington, Mass.-based Ipswitch Inc., which has WSFTP, a competing consumer FTP utility, is also moving into the enterprise market with a secure FTP server and other services.

FTP security: Which Internet protocol is more secure: FTPS or SCP? In this expert Q&A, Michael Cobb reviews the strengths and weaknesses of various Internet protocols. Learn the pros and cons of FTPS, SCP and SFTP. Data leakage detection and prevention: While corporate data loss is not a new concern, newer technologies are emerging to help combat the threat. In this tip, Joel Dubin advises how to reduce data leaks, reviews products that can identify network vulnerabilities and keep mobile device data secure. If email attachments are sent via SSL will they be encrypted? This application security Ask the Expert Q&A explains what happens to traffic that travels over an SSL connection and details how to keep email messages and attachments secure as they travel to and from email clients and SMTP servers.

Most vendors offer products that are beyond basic FTP, allowing businesses to securely transfer billing data, funds transfer and large data recovery files. To avoid sniffing and other security issues, the vendors add support for SFTP to provide secure file transfer or FTPS, to enable data encryption.

Frank Kenney, a research director at Stamford, Conn.-based Gartner Inc. said the vendor that does well in the enterprise space must integrate easily with company systems. Companies will seek out vendors that embrace Web services and offer adapters and APIs to simplify deployment and interoperability, Kenney said.

"Companies need to manage how files are coming into and out of the environment and if they leave Port 21 open they'll have issues," Kenney said. "If companies are not going to give their employees an alternative then they'll have data sent using peer to peer connections, instant messaging and other ways that can cause serious security issues."

Robert Oslin, director of product management at GlobalSCAPE, said the vendor has been responding to the needs of its business customers by adding features via modules. While there are no plans to add support for UNIX based systems, integration with other company systems is being addressed, he said.

A popular module is a secure adhoc transfer, which allows companies to set up temporary secure FTP accounts letting customers and business partners transfer large files to the company server.

Many companies use scripts to allow business partners and customers to transfer large files.

"It's become a maintenance nightmare," he said. "Many businesses had multiple scripts to manage and they wanted to consolidate, but they need something that can bring the different pieces together and do everything."

For Grange insurance, the roll out of a secure FTP server allows the company to automate transfers between its mainframe and outside vendors. The company plans to launch a temporary account creation site to allow its employees to create temporary file transfer accounts, Smith said.

"It's allowing us to increase security while offering more functionality to our end users," he said.