Declining relevance of unsafe FTP-servers

FTP-servers used to be an effective mean to exchange large files in companies. Anything beyond the usual level of email attachments was "parked" on an FTP server by the sender, where one or more recipients could download them again. However, this was not only complicated (logging in on the FTP-server, preparing files for exchange, uploading and possibly sorting them in folders), but also seriously compromised in terms of safety.

Security flaws of FTP-servers

FTP-servers do have an access control mechanism (user name and password); however, the data transfer according to the File Transfer Protocol (FTP) is unencrypted. This means that the entered passwords are transferred in plain text, i.e. completely unencrypted. Therefore, it is an easy game for attackers to view the content of the transferred data as “man in the middle” during the upload and download of sensitive files. Also, the seemingly “secure” SFTP-version only encrypts data during transfer, but not during storage. Furthermore, shadow-IT develops with the use of public FTP-servers and becomes nearly uncontrollable for the IT-department and company management: It cannot be traced, who sent which files to whom and where they might be publicly accessible.

Lacking user satisfaction and the mentioned security flaws have made the FTP-solution for data exchange fall behind increasingly. This is also due to the fact that FTP-servers contain no managing tools or search functions – there are only files, but no document management features or possibilities to work online on documents together as team.

Modern FTP-alternatives: Cloud-based solutions

Instead of data exchange via FTP, cloud-based data exchange platforms are becoming more popular. Such solutions offer end-to-end encryption as a central feature, guaranteeing a secure data exchange. The files are also stored in encrypted form on the storage server between the sender and receiver. The system administrator of such a system enables controlled rights management. Thus, it is possible to also include third parties (clients, suppliers etc.) in the company-internal data exchange.

Cloud-based solutions can be integrated into the Windows network drive, so that files can be transferred via drag & drop. Furthermore, document management features can be implemented, which enable advanced search functions with well-thought-out content management and metadata that are not possible with FTP servers. In addition, the whole database can be clearly displayed in the web browser and equipped with additional search functions. Moreover, authentication systems assure the recipient of a file that the sender is really who he claims to be.