Optimizing Managed File Transfer (MFT): Dos and don'ts

July 14, 2011 — CSO —

Discourage data leaks, standardize and optimize file transfer—that's the ambition of Managed File Transfer (MFT) products. Here, experts offer practical advice on using these tools.

Learn about features and selection criteria in the companion article Automating and securing file transfers: Key issues.

DON'T look for a quick hit, one-off solution. You may think you only need to quickly solve a single problem, such as how to secure files emailed between your law firm and its clients. But most organizations have much more complex, large-scale file-transfer requirements and should take a long-term view of their needs.

July 14, 2011 — CSO —

Discourage data leaks, standardize and optimize file transfer—that's the ambition of Managed File Transfer (MFT) products. Here, experts offer practical advice on using these tools.

Learn about features and selection criteria in the companion article Automating and securing file transfers: Key issues.

DON'T look for a quick hit, one-off solution. You may think you only need to quickly solve a single problem, such as how to secure files emailed between your law firm and its clients. But most organizations have much more complex, large-scale file-transfer requirements and should take a long-term view of their needs.

"It's all about taking a holistic view of all your connections and risk and [how to] shut the door to new scripts, FTP servers, which created the problem in first place," says Chuck DePalma, CISO for Volkswagen Group of America. "If you just jump in and replace this one FTP server, companies wind up with five or six managed file-transfer products across the organization. You wind up with better tools, but no central governance."

DO use MFT as part of an overall data management program. It's critical to classify your data, know how it's used within the organization and in transactions with other businesses, customers, auditors, and so on, so you can apply appropriate policies and controls to various file-transfer use cases.

See dos and don'ts for using protocol analyzers | SIEM | IT GRC

Volkswagen, for example, wrote data usage and governance policy when it moved from its five-year-old Tumbleweed MFT to a newer version from Axway (which purchased Tumbleweed). Says DePalma, "The policy covers the proper way to manage the data and everything associated with it—data security, transmission, usage and sharing, vendor usage, employee usage, ownership rights to data, and who can do what and how to transfer it."

DePalma says VW learned a lot from its initial deployment in 2003.

"The easy-to-understand data was automatically put up [on the MFT systems]," says DePalma. "What followed was five years in process. We should have done a more rigorous process around data usage and governance ahead of time."

DO Look for < a href="http://www.csoonline.com/article/635421/the-executive-guide-to-data-loss-prevention">data loss prevention (DLP) capabilities. In addition to being deployed as a standalone product, DLP is increasingly being integrated into other systems, including MFT. DLP enables companies to enforce policy on the movement of sensitive data, whether it's intellectual property, business plans or customer information. If this is important to your organization, look for built-in DLP or native support for third-party DLP.