Policy on Using FTP Sites

Establish security policies around FTP usage.

The Internet File Transfer Protocol, or FTP, is a common method for sending files back and forth across internal and external networks. Security concerns around FTP require that its usage is carefully monitored.

Definition

FTP is a method of transferring files from one computer to another. It is based on a client-server architecture. One computer is set up as an FTP server. Users on client computers connect to the server and upload or download files to and from that server. It is an effective way to transfer files without floppy disks, tape drives or other media.

Considerations

Users connecting to FTP sites send their credentials across the network in clear text. A hacker using a sniffer can capture that data and use those credentials for unauthorized purposes. The protocol itself contains several vulnerabilities that can lead to buffer overflows, privilege elevation and command execution or denial of service. Some FTP sites even allow anonymous connections that permit the storage of potentially illegal content.

Policy

Organizations must set security policies around FTP. Internally, an organization can use FTP relatively safely to transfer files around a network. Externally, FTP must be disallowed. Secure FTP is a safer alternative to transfer files into and out of an organization. Secure Copy provides another more secure method to file transfer.

References

• Saint Corporation: Vulnerability Tutorial - FTP vulnerabilities
• Symantec: Network Intrusion Detection Signatures, Part Three
• CVE: CVE-2009-2521