Re: Secure file transfers

[scott hollatz <shollatz () D UMN EDU>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> We have a big push for using outsourced ASP/data hosting services here.  We have a strong policy for contract review, 
> including a security review.
>
> We've been insisting on secure file transfer methods for data exchanges between the university and the vendor.  We've 
> accepted VPN or SFTP as methods for data exchange, especially for those contracts where the data exchanges include confidential 
> data (we have a state law in Michigan that protects certain data such as social security numbers and credit card numbers).  Data 
> exposure (unauthorized access) of those data elements can result in a maximum $750,000 fine for the university.
>
> We've been getting a push back from some vendors that "standard FTP" is secure enough.  We've been saying it isn't good 
> enough.
>
> I am checking in on best practice.  I'd appreciate your thoughts on this.

We push for SFTP (for the exchange) of encrypted data (they must decrypt
after exchange).  Some view this as draconian but generally works fine.

One problem with this, though, is some vendors, including the military,
claim they can decrypt when in fact they cannot due to company policy
constraints or other technical issues in running some crypto software,
and some can't even do SFTP without some coaching from our end.

If they cannot do SFTP then at least the file is encrypted and they can
download from the web or anonymous FTP; however, if they also cannot
decrypt then an in-person exchange is done.  All workarounds depend on
data volume, of course.

> Thanks in advance -
> Theresa
> Theresa Rowe
> Assistant Vice President
> University Technology Services
> www.oakland.edu/uts - the latest news from University Technology Services

- --
scott hollatz                                        net shollatz () d UMn eDu
information technology systems and services          tel +1 218 726 8851
university of minnesota duluth mn usa                fax +1 218 726 7674
                                                                         --
                                              "Asn aD ta zlAp em uT zt33rg"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (SunOS)

iD8DBQFGPzYz4og1WWfEVRsRAgOjAJ9LxIIQhmQT7ixTyob2s4/whR7H7ACcC/+w
TKB8VGAtqYQF9Z1neN+erBI=
=EcPG
-----END PGP SIGNATURE-----