We see people searching for information on how to automate SFTP. Blogs have been written about it to try and steer the curious in one direction or another. But here’s the thing: it’s a trick question. You don’t automate SFTP, you support SFTP as a secure protocol for file transport, and then you automate the workflows that require SFTP. That’s it. That’s the trick. If that’s the answer you were looking for, you need not read any further. You’re welcome.
But I suspect there’s a different question lurking just beneath the surface; one that deserves a little more explanation. It goes something like, “If I send my files using SFTP, why do I need to PGP encrypt them as well? After all, if SFTP encrypts the transport channel, isn’t encrypting the file with PGP overkill?”
Let’s take a closer look at that question.
What is SFTP?
SFTP stands for Secure File Transfer Protocol (or Secure Shell File Transfer Protocol), and the name is also an accurate description of what SFTP is: an Internet Engineering Task Force (IETF) standard protocol for securing channels used for digital transmissions. SFTP was developed in 1997 after it became clear that a secure alternative to File Transfer Protocol (FTP) was needed. SFTP is platform independent, meaning networks and devices running Window, MacOS, Unix, Linux and other operating systems can support SFTP and, therefore, transmit data and files securely between dissimilar systems with no compatibility issues. As if to emphasize the need for SFTP vs FTP, federal security agencies like the FBI and CISA regularly issue warnings over cybercriminals targeting unsecure FTP servers and products that use FTP.
Using SFTP during the file transfer process ensures the security of the transport process, not necessarily the files being transferred by that process. You see, when a managed file transfer (MFT) solution sends a file, there’s data that accompanies the file so that the recipient knows who the transfer is from and can authenticate the transmission. It also keeps unauthorized parties from collecting any associated passwords, identifiers, or manipulating the data in any way. That means the sender and recipient can be certain that the files contain only what the sender intended. When files are transmitted over a channel secured by SFTP, all parties can have a high degree of confidence that the data is legitimate.
Do all MFT Solutions Support SFTP?
Unfortunately, there are still some managed file transfer products that support FTP. Often these occupy the lower end of the market or are among the range of free/open-source options. These products could be categorized as “shadow IT” as they are often downloaded and put into service as a spot solution to meet a need without going through review. That creates a critical vulnerability that can be easily exploited. This is a case of being penny wise and pound foolish as the costs saved by using free/cheap FTP are not worth the risks and costs of a critical data breach.
Instead, when choosing an MFT solution, look for one that is equipped with a full slate of security features and a security-first architecture consistent with the standards set by regulations like HIPAA, GLBA, SOX, GDPR, and others. In addition to SFTP, security features to look for include multi-factor authentication, least-privilege access control, threat intelligence, and PGP encryption management.
Do I Really Need PGP and SFTP?
There’s one more question that comes up occasionally that I want to address here. If a managed file transfer solution supports SFTP for encrypting the channel over which I’m sending my files, why do I also need to encrypt those files using PGP?
That’s a good question, and the answer is yes, because SFTP and PGP address two different needs in the security of a managed file transfer workflow: SFTP encrypts that data being transmitted with the files, while PGP encrypts the files themselves. That is a guard against common security threats like misuse, misdelivery, and situations in which a threat actor attempts to intercept files through deception or a man-in-the-middle attack.
Some low-end file transfer products don’t support the necessary security protocols for protecting data in transit and at rest. That means organizations that use them are forced to either add a third-party tool for data encryption, tackle the job manually, or send sensitive data in the clear. None of those options is ideal as they put the organization, its partners, customers, employees, and others at risk of being exposed to a data breach. They also increase the likelihood of problems associated with human error.
According to a recent Verizon Data Breach Investigations Report (VDBIR), file misdelivery was a factor in 43% of errors leading to a data breach. That’s a lot of sensitive, unencrypted data ending up in the wrong in-box and a lot of uncomfortable questions that need answering when the intended recipient calls asking for the files you were supposed to send, or when someone from legal starts asking why the U.S. Department of Health and Human Services is inquiring about a HIPAA violation.
Choosing the Right MFT Solution for SFTP and PGP Automation
Because of the sensitive nature of the data that is often involved in a file transfer (medical, financial, operational, personal, intellectual property, etc.), there is no excuse for cutting corners. You need a full-featured MFT solution that is built on a security-first architecture and that boasts state-of-the-art features for security and productivity. That includes support for SFTP and automated PGP management as well as:
Workflow data capture and archiving and with one-click audit reporting- Multi-factor authentication and authenticator application support
- Access control based on the principle of least-privilege
- Support for post-quantum cryptography
- PGP automation for in-browser transfers
- LDAP integration for policy consistency
- MFT workflow endpoint mapping
- Dry-run workflow testing
- Threat intelligence
To make it simple, we’ve put all those features into our Diplomat MFT Enterprise Edition managed file transfer solution. Our customers include some of the largest healthcare, financial services, government, logistics, and manufacturing organizations in the world because we take security seriously. In more than twenty years, Diplomat MFT has never been breached. We’d love to talk about how Coviant Software can help you solve your biggest managed file transfer challenges, so why not arrange a conversation today?