• open panel
  • Home
  • Archive by category 'File Transfer Discussion'
  • Page 2

Archive for ‘File Transfer Discussion’

Dropbox or MFT – that is the question…

Once again the spotlight has been turned on Dropbox following their recent investigation into irregularities in their service.  This latest occurrence appears as though it will conclude with Dropbox announcing that a number of their European users email address or account details have been compromised, we’ll watch with anticipation for the outcome.

Whilst cloud solutions certainly offer users with a raft of features currently not offered by other proprietary software vendors, they tend to lend themselves to being targets for hackers due to their high profile and wide adoption.  It begs the question, “Should consumer grade cloud based technologies be allowed within the enterprise at all?”Dropbox Technologies

Managed file transfer vendors are fast catching up with the cloud based solutions, adding Dropbox like features to provide users with the simple way of working to which they’ve become accustomed.   Whilst also adding new features such as mobile file sharing capabilities to cover off the BYOD angle, never before have MFT vendors being trying so hard to keep up with the contemporary features that users are demanding.

There are many benefits associated with implementing an in-house managed file transfer solution.  Possibly one of the most important in terms of security (taking into consideration the above) is the fact that they don’t become a high profile, data centre target.  Taking the understated, in-house deployment may well help you to slip under the radar whilst also providing a range of security features.

If your company is using Dropbox to share data then Pro2col can help.  We’ve worked with various companies across a range of industry sectors to replace consumer grade file sharing technologies.  Call one of our sales consultants on 0333 123 1240.

Share on TwitterShare on FacebookShare on LinkedIn+1
 

Award for the Best Managed File Transfer Vendor goes to…

According to a recent study of managed file transfer vendors undertaken by the Info-Tech Research Group, one of our key vendors GlobalSCAPE received the highest praise and was afforded the award of best managed file transfer vendor.  As GlobalSCAPE’s Master Partner here in the UK, we’re very pleased with the high praise and we concur with the assessment that GlobalSCAPE… “has an extensive feature set, solid price point, and clear strategy. Meeting advanced security requirements with extensive security modules combined with anti-flooding and auto-ban features, GlobalSCAPE offers 24 x7 support to quickly respond to any potential problems that occur.”

In addition Ipswitch File Transfer were also recognised as a Champion in the study impressing the analysts with a strong, well rounded product portfolio.  Again, as Ipswitch’s Elite Partner here in the UK we recognise the value that Ipswitch’s MOVEit range of technologies provide, accompanied by a strong feature set.

InfotechWith the sunsetting on Gartner’s Magic Quadrant back in 2010, there has certainly been space for an analyst report on managed file transfer vendors and solutions.  I think that the Info-Tech report has a little way to go to reach the breadth of MFT industry content that Gartner achieved but it shows that we’ve chosen well in selecting the best vendors to work with.

If you’d like to discuss how either GlobalSCAPE or Ipswitch’s Managed File Transfer solutions could help your business, we’re perfectly placed to assist you in helping you to select the right MFT solution for your needs.  Please get in touch on 0333 123 1240.

Share on TwitterShare on FacebookShare on LinkedIn+1
 

Free managed file transfer software: Is open source really an option?

Over the past couple of weeks I’ve spoken with a number of companies who’ve wanted to implement a managed file transfer solution but haven’t had the budget to implement something from one of our vendors.  With more than a couple of these companies I was asked the question – do you know of any free managed file transfer solutions, you know something open source, something we can deploy on Linux?

Given that our business focuses on selling file transfer technologies and ‘free’ doesn’t quite pay the bills, I was somewhat surprised to be asked this question. However, as I’m a bit of a file transfer geek I had in fact researched this in the past I knew that there were not – the best I could find was a couple of Sourceforge FTP server projects.

I completely understand a company wanting to keep the cost of their technologies down, preferring to deploy on a Linux platform.  We’re no different and

Open Source

run a number of our mission critical systems on various flavours of Linux and have been deploying Linux solutions for about 8 years now. There are several vendors with great technologies which can be deployed on Linux – Linoma and Axway and a quick look at the price tag would confirm that these solutions certainly aren’t open source.

It got me thinking whether the open source route was something which could be explored in the same way other technologies have, but I concluded that we’ve got enough on our plate at the moment servicing the needs of our existing clients and those willing to pay for software.  Whilst open source works in some aspects of business, companies needing to move mission critical data want a structured development roadmap and enterprise level support too.

Share on TwitterShare on FacebookShare on LinkedIn+1
 

Enabling the mobile workforce with Managed File Transfer

The proliferation of mobile devices within the enterprise is undeniable with tablets and smart phones becoming key tools for employees looking to ‘get the job done’.  Many CIO’s and IT Directors know they have a problem with ensuring the secure and controlled mobile access to data, but what’s the solution?

Should access be restricted completely and a ban be placed on BYOD (Bringing Your Own Device) to work?  Or should your staff use internal tools such as Sharepoint, live with its inadequacies and struggle on with their limitations knowing that its not specifically built for the job?  Or do you take on the challenge of choosing the right tool for the job?  Realistically the choice is already made as there’s no easy way in which to stop people using mobile devices.  The most effective route is to provide them with the right tools to be successful in their jobs, whilst giving IT and security teams the tools that they need to manage users, set security policy and privileges.

Some key thoughts you should consider when selecting a mobile enabled managed file transfer solution are:

Mobile File Sharing

  • What mobile / tablet platforms do you need to support?
  • Is there a business need for a mobile application or will a browser based interface suffice?
  • How many users do you intend on providing the technology to?
  • How will you restrict access to data, e.g. users home folders only?

At Pro2col we’ve been helping companies to secure their data since 2003 and securing the mobile workforce isn’t a great deal different.  Of course there are a few different considerations to take into account, but that’s all part of what we do.  We work with a wide range of managed file transfer vendors, not all of whom want to be listed on our web site but who are taking the secure exchange of data with the mobile workforce very seriously.  Different vendors take different approaches to addressing the problem.  We work with vendors who have approached mobile file sharing from very different perspectives, which might form another blog item.

The experience we’ve gained in helping other enterprises address their mobile file sharing problems can help your business too.  Overcoming the challenge of securely exchanging data with remote workers across a range of mobile or tablet platforms, doesn’t need to be a hassle.  Get in touch with our team of technical specialists on 0333 123 1240 to work out what’s most suitable for you.

Share on TwitterShare on FacebookShare on LinkedIn+1
 

Hosted v’s On Premise Managed File Transfer

Over the past couple of years there has been considerable hype around saas, hosted or cloud based solutions – the managed file transfer marketplace has been no different.  We speak to many businesses on a daily basis about their file transfer requirements and inevitably, a number of them ask for a cloud based solution. So we’ve been speaking to a range of our vendors, natural leaders in the software field, but many of them seem unwilling to step out of their traditional marketplace and into the cloud space.  There are of course good reasons for this.  For example, the impact on existing software sales, the responsibility that goes with managing other peoples data and probably most importantly, the size of the market. According to Gartner only 10% of the managed file transfer marketplace actually relies upon a cloud based solution.  With the managed file transfer sector experiencing +20% growth year on year and the shift to cloud solutions not likely to slow any time soon, transition to cloud services could become the next major battlefield for vendors. However as it stands, this certainly isn’t reflected in the managed file transfer marketplace as there are many more software vendors than service providers.

Laptops in the Cloud

If you’re thinking about implementing a hosted or on-premise managed file transfer solution, there are a number key points to consider.  Here are a few to start you off:

Cost of Ownership

Cost is the number one factor influencing the choice of managed file transfer solution for most businesses.  Implementing and managing an on-premise MFT solution can be pricey, some of the costs to consider are:

Software – The initial software purchase price can range from £5,000 to in excess of £50,000 but once this has been paid, the solution is yours.  Although hosted services appear cheaper in the short term, ongoing subscriptions can be costly in the long term.

Hardware – Providing an environment to install and run the MFT solution can also add up, especially when you take into account disaster recovery or high availability.

Infrastructure – Hosting files on your own server can prove a problem, bear in mind the impact on your Internet connection when a 1Gb file is shared with 50 or more external users!

Support & Management

Another point to take into account after the initial go-live of a managed file transfer solution are the costs associated with ongoing support and management. Specifically:

Internal Support – If you deploy an MFT solution, the responsibility of support and management falls on internal team members, whereas with a hosted solution much of the ongoing support is outsourced to the service provider.

Availability – Generally hosted services run in high availability data centers.  Therefore, they offer guaranteed uptime with load-balanced solutions as the norm and include SLA’s.

Scalability – In a hosted environment, scalability of your product is generally available on demand or at the touch of a button.  It’s not always quite so simple with an on-premise MFT solution.

Back-up/disaster recovery – Usually provided as part of the service by hosting providers, back up and disaster recovery can be costly when purchased as part of a solution package.

Deployment

Bringing an on-premise managed file transfer solution online has its challenges. Ports need opening on firewalls, rules need setting up, plus there are considerations about the design of the solution and how it will sit within the corporate infrastructure.  Hosted solutions are incredibly fast to deploy given that much of the above doesn’t come into play.

Functionality & workflow

Typically, functionality and workflow features are key drivers in the decision making process. On-premise managed file transfer solutions offer far more in the way of a comprehensive feature set:

Bottlenecks – Having files local to you, when you need them can save a considerable amount of time in terms of loss of productivity, especially for larger enterprise deployments.  Pushing data to remote services can impact upon an end users time or can delay internal processes.

Integration – More often than not, hosted solutions are somewhat limited in the level of integration capabilities they offer.  This is an important factor to take into consideration as lack of integration reduces the potential to automate tasks and minimise the man hours wasted on routine tasks.  There are of course exceptions to the rule as there are some very capable hosted technologies.

These are just some of the key areas to be mindful of if you’re weighing up the pros and cons of hosted vs on premise managed file transfer solutions.  Ultimately, the decision will be fueled by the scope of your requirements and the size of your budget.  Whatever these may be, there is a managed file transfer solution out there to fit your business needs.  If you want some help pinpointing the right solution for you, please contact Pro2col on 0333 123 1240.

Share on TwitterShare on FacebookShare on LinkedIn+1
 

Moving On From FTP: Where To Begin

“My company still relies heavily on FTP.  I know we should be using something more secure, but I don’t know where to begin.”

Sound familiar?

The easy answer is that you should migrate away from antiquated FTP software because it could be putting your company’s data at risk – unsecured data is obviously an enormous liability.  Not only does FTP pose a real security threat, but it also lacks many of the management and enforcement capabilities that modern managed file transfer solutions offer.

No, it won’t be as daunting of a task as you think.  Here’s a few steps to help you get started:

FTP

  1. Identify the various tools that are being used to transfer information in, out, and around your organisation.  This would include not only all the one-off FTP instances, but also email attachments, file sharing websites, smartphones, EDI, etc.  Chances are, you’ll be surprised to learn some of the methods employees are using to share and move files and data.
  2. Map out existing processes for file and data interactions.  Include person-to-person, person-to-server, business-to-business and system-to-system scenarios.  Make sure you really understand the business processes that consume and rely on data.
  3. Take inventory of the places where files live.  Servers, employee computers, network directories, SharePoint, ordering systems, CRM software, etc.  After all, it’s harder to protect information that you don’t even know exists.
  4. Think about how much your company depends on the secure and reliable transfer of files and data.  What would the effects be of a data breach?  How much does revenue or profitability depend on the underlying business process and the data that feeds them?
  5. Determine who has access to sensitive company information.  Then think about who really needs access (and who doesn’t) to the various types of information.  If you’re not already controlling access to company information, it should be part of your near-term plan.   Not everybody in your company should have access to everything.

Modern managed file transfer solutions deliver not only the security you know your business requires, but also the ability to better govern and control you data as well as provide you with visibility and auditing capabilities into all of your organisations data interactions, including files, events, people, policies and processes.

So what are you waiting for, give Pro2col a call on 0333 123 1240 and let us help you replace your legacy FTP solutions.

Share on TwitterShare on FacebookShare on LinkedIn+1
 

Secure Managed File Transfer: On Premise v’s The Cloud

Everybody is talking about the cloud; its today’s hot topic with more and more organisations considering a cloud-base (hosted) solution as an alternative to their current on-premise solution.  The shift to cloud based computing is gathering pace and consequently this is an area we’ve been looking at quite closely.

So, is Cloud based secure managed file transfer for me and what are the biggest drivers behind this trend?

1.  Its cheaper! Many IT departments spend at least 50% of their budgets on salaries, and up to 70% of IT staff time is spent on maintenance, according to analysts. In-house IT specialists cost companies for IT management resource. A hosted service, on the other hand, may charge a much-reduced figure for its service along with 24–7–365 monitoring and higher uptime than many companies can achieve with on-premise staff and systems.

Managed File Transfer in the Cloud

2.  Hosted providers can do it better. Hosting vendors store the information on their own servers and manage the entire system for you, drastically reducing the time and energy you spend on keeping your MFT up and running. A growing number of companies just want MFT isolated as an enterprise-class cloud service, with all the modern archiving, compliance and virus protection features they require along with a scalable infrastructure their IT staff never has to worry about or manage.

3. The cloud has gone mainstream. Primed for enormous growth and widespread adoption, recent research indicates that 84 percent of small and mid-size companies and 69 percent of large companies are willing to consider, currently reviewing or already using software-as-service (SaaS) solutions. A big part of this growth is a result of the increase in broadband Internet access, but another key factor is that cloud MFT vendors are making better, simpler and more affordable software that doesn’t require a technical degree to setup or use. It’s also more widely accepted as a safe alternative to on-premise solutions.

4.  Pay as you go. As budgets tighten in this tougher economic period, more and more companies are gravitating toward cloud-based solutions. With no technology to maintain, total cost of ownership is five to 10 times less than installed software, so it’s easier to budget and scale as you add and subtract users. In addition, cloud-based solutions do not require ongoing maintenance, time or complex upgrades, so what was once a capital expense becomes a more balance sheet-friendly operating expense.

As this shift to cloud based computing continues to gather pace, Pro2col is at the forefront of assessing the industries leading vendors to ensure we know which solution is right for your budget and set of requirements.

But, the Cloud isn’t for Everyone

Despite all this optimism for the cloud, we know there are plenty of situations where it may not make sense to move your MFT there. Some data may need to remain on-premise, behind a firewall for legal or regulatory considerations (e.g., HIPAA). Also, other on-premise applications (e.g., document workflows) may be tightly integrated with your on-premise MFT system, so moving your MFT to the cloud could pose challenges if you are hoping to continue coupling these solutions. Finally, many organisations may not have fully made use of their existing on-premise MFT solutions (i.e., they have already invested in it) and may not be able to easily or practically abandon it.

For independent advice on Cloud/Hosted FTP or On-Premise Managed File Transfer solutions contact Pro2col on +44 (0) 333 123 1240 or +44 (0) 1202 433 415.

Share on TwitterShare on FacebookShare on LinkedIn+1
 

What’s the Most Common Way YOU Send and Receive Large Files?

We’re interested to find out what’s the most common way that you send and receive large files. If you’ve got a spare minute and fancy taking part in our mini poll on LinkedIn – here’s the link to follow:

http://polls.linkedin.com/p/111142/zgtbx

We’ll look forward to hearing from you!

Question Mark

Share on TwitterShare on FacebookShare on LinkedIn+1
 

How will the changes to PCI DSS affect you?

The PCI Security Standards Council have just released version 2.0 of PCI DSS, the Data Security Standard enforced upon all merchants that accept any form of card payments, designed to secure and protect cardholder details.  Although introducing only minor alterations, the main intention of the amendment is to provide greater clarity and flexibility for small merchants, facilitating a more comprehensive understanding of the requirements that must be satisfied under PCI DSS and making them easier to implement and abide by.

From a long term perspective, the amendments made are designed to help merchants manage evolving risks and data security threats whilst maintaining alignment with industry best practices.  Taking a higher level perspective, the main changes cover:

  • Reinforcement of the need to conduct thorough scoping exercises, so that merchants can identify exactly where their cardholder data resides in the business.
  • The need for more effective log management of credit card data within the business.
  • Allowance for organisations to adopt a more risk based approach when prioritising vulnerabilities, taking into account their specific circumstances.
  • The acceptance of unique business environments and accommodation of their specific needs.

More specifically Jonathan Lampe, VP of Product Management at Ipswitch File Transfer and representative of the PCI Security Council has identified the 5 key changes that will directly effect the transfer of sensitive credit card data:

  • Explicit recognition of SFTP  as a secure protocol.
  • Audit of virtual machine infrastructure and virtualisation hypervisors will be brought within the scope of PCI DSS.
  • Rotation requirements for the purposes of key management will be “based on industry best practices and guidelines” rather than an annual stipulation.
  • Identity and authentication requirements for users, “non-consumers” and administrators will be split further.
  • More specific requirements will be implemented around the auditability and security of timekeeping, especially as recorded in audit logs.  (Coordinated and reliable timestamps are helpful during civil and criminal investigations as well as internal forensics investigations.)

A further step taken by the PCI council to help small merchants achieve the latest 2.0 PCI DSS changes is the introduction of a small microsite.  The implementation life-cycle the of PCI Council’s standards will be extended from the current 2 years to 3 years to give merchants plenty of time to make the necessary changes.  The new 2.0 standard will be effective from 1st January 2011, however validation against the previous 1.2.1 standard will be allowed until 31st December 2011.

For more information regarding PCI DSS compliance and how this can be achieve in terms of secure file transfer, please don’t hesitate to contact the team at Pro2col on 0333 123 1240.

Share on TwitterShare on FacebookShare on LinkedIn+1
 

Data: Transferring the Burden Under PCI DSS

GT News have just published a great article written by Jonathan Lampe (Vice President of Product Management at Ipswitch) regarding data transfer requirements under PCI DSS.  If anyone is looking for a PCI DSS compliant solution for file transferring data, these are the points they really need to be taking into consideration:

Data: Transferring the Burden Under PCI DSS

Jonathan Lampe, Ipswitch – 08 Jun 2010

Despite widespread adoption of Simple Object Access Protocol (SOAP) and transaction sets in the financial industry, a surprising high percentage of the data flow is still represented by files or bulk data sets. In 2009, Gartner determined that bulk data transfers comprise around 80% of all traffic. This is probably a surprise if your company is among the many with millions invested in just managing individual transactions – but there are good management and security reasons for this continuing situation.

Why is File Transfer Still Common?

Financial institutions and item processors are still ‘FTP’ing’ (file transfer protocol), emailing, or sending and sharing files instead of transactions for a number of reasons. First, it helps hide the complexity of systems on both ends – there is no reliance and concern regarding libraries of transactions and responses related to one system and a different set related to another system. Second, it reduces the risk of transmission failure and makes it less risky for employees to send a small number of files or bulk data sets rather than a large number of transactions. Finally, it also increases the reliability of an overall operation.

The Managed File Transfer Industry

The managed file transfer (MFT) industry is comprised of providers whose solutions manage and protect these bulk data sets as they move between partners, business areas and locations. Collectively they address challenges presented by bulk data transfers and principles-based rules of the sort that have become common over the past few years – for example the Data Protection Principles or International Financial Reporting Standards (IFRS). Fundamentally, rules that tend to embody real-world outcomes as a standard. So, for example, the reported outcomes of penetration testing depend for certification as much upon the experience of the tester (who may be an employee) as upon the integrity of the network. This is all fine – until your network meets the real world. Principles-based rules tend to put the onus squarely on us to make and maintain systems.

For consumers, consultants and Payment Card Industry (PCI) assessors, this is undoubtedly ‘a good thing’. For those handling card data, the costs of validated and effective compliance represent a potentially significant burden that’s worth passing on to an industry that has quietly got on with the job well before buzzwords, such as ‘cloudsourcing’ or even ‘outsourcing’, entered the lexicon.

Vendors and Technologies Need Evaluation

It therefore makes a great deal of sense to place as much of that onus, and indeed risk and potential liability, on the shoulders of others – suppliers and consultants – as we can. Although PCI Data Security Standard (PCI DSS) can, and does, descend into tick-box detailed level rules in some places – which it makes very good sense to sign off to trusted third parties – nevertheless, significant ongoing parts of our obligations under PCI DSS are essentially management issues. Despite subjective components and PCI requirements to take ongoing account of best practices, the technologies themselves can still be evaluated on a relatively straightforward mechanistic basis, provided that they are submitted to sufficient scrutiny.

At the most basic level, subjective terms such as ‘adequate’ or ‘insecure’ are sometimes to be understood (explicitly or otherwise) as denoting specific technologies or other standards in line with industry best practice and are, therefore, a route to initially evaluating software on a tick-box basis.

Beyond Ticking Boxes – Four Initial Considerations

When evaluating for data security technology in the context of regulated activities, you should look at how four categories – confidentiality, integrity, availability, and auditing – contribute to security and compliance. These headline considerations are designed to assist in assessing whether a data technology or process is likely to provide one-time compliance for the purposes of PCI DSS.

Confidentiality ensures that information can be accessed only by authorised individuals and for approved purposes. For the purposes of PCI DSS this means that employees should have the minimum level of access necessary to do their job. Confidentiality begins with authentication of login credentials on every secure application and starts with putting a strong password policy in place, with robust account expiry procedures and password management.

Integrity, as repeatedly addressed in PCI DSS rules 10, 11 and 12, is relatively under-appreciated and understood solely as a security issue, but is a critical component to compliance. It means ensuring the uncompromised delivery of data, with full Secure Hash Algorithm (SHA)-512 support. In the case of file transfer operations, non-repudiation takes data security to the highest level currently available by adding digital certificate management to secure delivery and data encryption beyond the requirements of PCI DSS. The setting up of alerts is a relatively easy goal – a box ticked on the route to compliance.

Availability is not explicitly addressed in PCI standards but is a critical component of any overall security strategy. It can and should be addressed, if not guaranteed, through load balancing and clustering architectures that support automatic failover and centralised configuration data storage to minimise the chance of a data breach.

Auditing capabilities should be demonstrated by vendors in the form of comprehensive logging and log viewing with tamper evident measures to guarantee the integrity of log files. For technology, security, and other auditing purposes, all client/server interactions and administrative actions should be logged.

The Hitchhiker’s Guide to File Transfer in the PCI DSS Galaxy

The main body of the PCI DSS is divided into 12 requirements.PCI Logo

Section 1 establishes firewall and router configuration standards by requiring all managed file transfer (MFT) vendors to build a product architecture that puts a proxy, gateway or tiered application into a demilitarised zone (DMZ) network segment. This requirement also puts the actual storage of data and any workflows associated with it into internal networks.

The best architectural implementations ensure that no transfer connections are ever initiated from the DMZ network segment to the internal network. Typically this is accomplished using a pool of proprietary, internally established connections. In this way, clients can connect using FTP Secure (FTPS), Secure File Transfer Protocol (SFTP), etc to the DMZ-deployed device, but the transfers involving internal resources are handled between DMZ- and internally-deployed vendor devices by the proprietary protocol.

Section 2 demands that no default or backdoor passwords remain on the system and that systems are hardened. These best practices are generally enforceable with MFT technology, but the best implementations include a hardening utility that also extends protection to the operating system on which the MFT software runs.

Section 3, particularly subsection 3.4, covers encryption of data and storage of keys. To address these issues MFT vendors have an array of synchronous and asynchronous encryption technologies, such as OpenPGP, to ensure data is secured at rest. Cryptography is almost always performed using Federal Information Processing Standards (FIPS)-validated modules and secure overwrite of data is commonly used.

Section 4 covers encryption of data in motion. All MFT vendors currently support multiple open technologies such as Secure Socket Layer (SSL), Secure Shell (SSH) and Secure/Multipurpose Internet Mail Extensions (SMIME) in multiple open protocols, including SFTP, FTPS and Applicability Statement 2 (AS2), to provide this protection.

Section 5 ensures anti-virus (AV) protection is in place for systems and the data that passes through them. Most MFT vendors provide the ability to provide both types of protection with their software. The best allow integration with existing AV implementations and security event and incident management (SEIM) infrastructure.

Section 6 requires secure systems and applications. Most MFT vendors conform to the guidelines here, particularly subsection 6.5 on web application security. However, there are large variations on fidelity to subsection 6.6 in the industry. The best vendors use a battery of security assessment and penetration tools, such as HP WebInspect and protocol fuzzers, to ensure that their software exceeds PCI security requirements – and remains that way from release to release. The best vendors also have multiple security experts working with developers to ensure new features are secure by design. These attributes are not always easy to find on a vendor’s website, but they are critical to the long-term viability of an MFT application – be sure to ask.

Sections 7 and 8 cover the establishment of identity and authority. MFT solutions typically have built-in features that cover these issues from multifactor authentication to sharing of accounts. However, there are two common areas of difference between MFT vendors in these sections. The first is the ability to rapidly ‘de-provision’ users (i.e. disable or delete the account upon termination). The second is the proper storage of passwords: some vendors still use unkeyed hashes or weak Message-Digest algorithm 5 (MD5) hashes, both of which are susceptible to either rainbow table or collision attacks.

Section 9 is about physical access and is one that many software vendors erroneously ignore. However, subsection 9.5 is about off-site backups and is a function that MFT software often provides. One advantage of using an MFT solution for this purpose is that all the security benefits from the MFT solution flow into the backup process as well.

Section 10 is about auditing and visibility into data. MFT vendors also typically have a strong story around these attributes. Common features of MFT include visibility into the full ‘life cycle’ of files, aggregate reporting, detailed logging of every administrative action, and enforcement of specific service level agreements (SLAs). Some MFT solutions also ensure that audit logs and transfer integrity information are tamper-evident to ensure complete non-repudiation of data delivery.

Section 11 is about regular testing of systems and processes. As mentioned above, MFT vendors who perform these types of tests on their own solutions before releasing their software to the public should be sought out and preferred by companies that must adhere to PCI DSS.

Section 12 is about maintaining and enforcing a security policy down to the level of end user training. Like section 9, section 12 is another section many software providers erroneously ignore. However, the best MFT vendors know that providing fingertip reporting and good user experience to both administrators and end users can go a long way toward encouraging proper use of technology.

PCI DSS Appendices A (‘Additional PCI DSS Requirements for Shared Hosting Providers’) and E (‘Attestation of Compliance – Service Providers’) are also often used when managed file transfer services through virtual area network (VAN), software-as-a-service (SaaS), hosted or cloud providers are used. Key requirements here include ensuring that the service provider is not allowing shared users, that different organisations can only see their own logs and that the provider has policies that provide for a timely forensics investigation in the event of a compromise.

Summary

The substance of the PCI burden is an ongoing one. To look down the list of PCI requirements is to scan a list of enjoinders to ‘maintain’, ‘monitor’ and ‘ensure’, that echo the ‘manage, monitor and secure’ objectives of basic FTP technology. However, and, as the March 2008 Hannaford data breach shows, it is possible to be ostensibly compliant – to have ticked all the boxes – and yet not be fully secure.

PCI DSS compliance requires organisations to protect the security, privacy, and confidentiality of information – and to document who accesses the information and the security measures taken to prevent theft, loss, or accidental disclosure.

Click here for further information on the range of products by Ipswitch File Transfer or call Pro2col Sales on 0333 123 1240.

Share on TwitterShare on FacebookShare on LinkedIn+1
 
© Pro2col Ltd 2012 | Terms of Sale | Privacy Policy | Sitemap
Part of the Pro2col Group