According to Malcolm Forbes, “The difference between men and boys is the price of their toys.” That was the boastful perspective of a man known for his wealth and extravagant lifestyle, and who spent lavishly on many expensive toys. Absent from Forbes’ quip is the idea that, however we choose to spend our money, we must also consider the consequences of the decisions we make in the use of our available resources. That is what sensible adults do. To quote Uncle Ben Parker, “With great power comes great responsibility.”
Expensive Toys vs Effective Tools
With all due respect to Malcolm Forbes, most of us have limited time and resources to spend on our essential and optional purchases. If we use Maslow’s Hierarchy of Needs as a guide, our first responsibility is to satisfy the necessities of life; the things required for survival like food, water, air, warmth, clothing, and shelter. Expensive toys should be last on the list. In business, we must get approval from an executive committee or board of directors when spending money and justify each expenditure based on how it benefits the company or improves our ability to execute against our mission.
[Too many MFT vendors] are selling expensive toys. And the ones getting hurt are the customers.
Dr. Maslow puts safety second, which is a good thing to remember, especially when you are responsible for others. And as someone with the privilege of running a company that makes software used for sending and receiving important data files, it’s a good model to use for product development. Unfortunately, in the managed file transfer (MFT) industry, there have been too many examples of vendors skipping past the essentials of physiology and safety and going straight for self-esteem and self-actualization. In short, they are selling expensive toys. And the ones getting hurt are the customers.
Crushed by Threat Actors
CrushFTP is the most recent example of a product that has no business being anywhere close to a company’s sensitive data. According to Security Week, a vulnerability in CrushFTP allowed attackers to bypass authorization to gain direct access to systems and data. The vulnerability was discovered in mid-March, and cybersecurity researchers say the flaw was being exploited by threat actors into at least April. Customers were notified and a patch made available by late March, however confusion over the assignment of a CVE for tracking the exploit may have contributed to delays.
According to Security Week… CrushFTP allowed attackers to bypass authorization to gain direct access to systems and data.
Cybersecurity Dive reported that the “vulnerability… allows attackers to bypass authentication and gain port access to the file transfer server. The flaw received a CVSS score of 9.8 because it can be remotely executed and is easy to exploit.” CVSS refers to the SANS Institute’s Common Vulnerability Scoring System, which ranks software on a risk scale from 0 (None), 0.1 – 3.9 (Low), 4.0 – 6.9 (Medium), 7.0 – 8.9 (High), to 9.0 – 10.0 (Critical). That the CrushFTP vulnerability was assigned a 9.8 critical rating is a damning indictment of the coding behind the product. When you consider that the key function of managed file transfer software is to access and move data to and from internal resources, it is essential to pay close attention to security. When you neglect security, whether by omission or commission, you do great disservice to the customer and to the MFT industry. And our industry has suffered too many black eyes over the last few years.
Put Away Childish Things
The challenge, of course, is that software is written by humans and humans are prone to make mistakes. No one is perfect but when you start with a secure-by-design ethic, pay attention to security trends, and test test test every iteration of your software, you can minimize the risk of error and ensure that any errors that do occur are likely to be less severe.
Otherwise, instead of resulting in an MFT platform that is an effective, enterprise-grade tool, you end up with software that is little more than an expensive MFT “toy.” And in contrast to Malcolm Forbes’ love of toys, I prefer the perspective of Saint Paul who wrote, “When I was a child, I spoke as a child, I understood as a child, I thought as a child; but when I became a man, I put away childish things.”
If you are ready to put away childish MFT things, get in touch. Coviant Software has been providing rock-solid managed file transfer products with a stellar security record for more than twenty years. Contact us with your questions or to schedule a demonstration today.