“Ipswitch FT’s secure MOVEit solution gives us full visibility and management of file transfers, and enables us to avoid fines of up to £250,000 for non-compliance…”

Wayne Watson, information security manager for NHBC 

The National House-Building Council (NHBC) , the UK’s leading home warranty and insurance provider has greatly expanded its use of MOVEit to ensure the organization adheres to  file transfer best practices, while meeting compliance with internal standards and external regulators, including the Financial Conduct Authority (FCA).

Securing Builders’ Drawings, Architectural Designs, Legal Files and More
Secure, managed file transfer (MFT) is a high-priority for NHBC. In the past six months alone, the company has doubled the number of employees successfully using MOVEit, with over 200 active users now securing file transfers. Its business straddles the heavily regulated insurance and building sectors, and daily activities demand a constant flow of secure, confidential, copyright and personal documents and communications. These include builders’ drawings, architectural designs, legal files and more, sent between internal departments and on to external stakeholders such as solicitors, lawyers, builders, architects and homeowners.

No More File Sharing Via USB drives, Email Attachments, or Unsecured Apps
By using Ipswitch File Transfer’s MOVEit technology, NHBC now meets strict ISO 27000 internal security standards and exceeds compliance and regulation requirements such as those set by the FCA and the Data Protection Act (DPA). Previously, NHBC employees had to encrypt and share files via SD cards, USB drives, CD-Rs, email attachments and an assortment of unsecured web-based file sharing apps. But a tremendous shift in attitudes in recent years has led to more organizations like NHBC integrating MFT platforms, making unsecured email attachments and portable media things of the past.

Wayne Watson, information security manager for NHBC, said: “Ipswitch FT’s secure MOVEit solution gives us full visibility and management of file transfers, and enables us to avoid fines of up to £250,000 for non-compliance, as well as maintaining our company’s 75-year trusted reputation.”

Employees see webmail, file sharing services, cloud storage, USB sticks and smart devices as easier to use than traditional corporate tools to transfer files. But this trend ignores the security risks and regulatory implications of using file transfer methods entirely outside of corporate control.

Here’re five things you should know about your employees’ habits and the need for secure file transfer technology:

1) Insecure means are used to send confidential files.Recent surveys we have run to monitor user behavior found that a vast majority (84%) of respondents send classified or confidential information through corporate email attachments. Of those, 72% do this at least weekly and 52% daily. That means employees are using unsanctioned tools in record numbers, resulting in a lack of visibility and control.

2) Many employees use personal email to send company documents and data.
Users may think they can’t afford delays or slowdowns associated with jumping through perceived hoops to send out information and files that keep business humming. And if the business doesn’t provide the tools they need to send large and confidential attachments, or if the processes and technologies are too difficult to use, then users will take matters into their own hands – and their own email.

3) Employees are using consumer-grade file transfer services for business purposes.
If the corporate email system limits the size of file attachments or if IT vetoes service requests, resourceful employees don’t throw up their hands in resignation: they look for workarounds. And the growing popularity of file transfer sites and cloud services aimed at consumers is making it easier for business users to sidestep IT. More than half of the users we surveyed admitted they use these services.

4) Risk of data theft is high.
When business users aren’t turning to personal email accounts or free file-sharing services, they may be putting files on USB thumb drives, smartphones or other external devices. Unfortunately, our market research shows that almost one-third of users had lost a USB device, smartphone or other external device containing business or personal information – a tremendous risk for any organisation.

5) IT Management Visibility into Data Management is Low, Putting Businesses at Risk.
Most companies create and maintain policies that mandate the use of approved tools for moving and sharing information. However, our research shows fewer than 32% strictly enforce these policies, making these mandates largely meaningless. No visibility means no compliance with internal policies or external regulations and laws.

The file sharing habits of employees can be risky but is driven by their desire to get work done. The business need and IT desire to control file sharing is equally important. Fortunately, companies don’t have to choose between risky behavior and productivity. Using secure managed file transfer technology, employees can get the convenience, ease-of-use, and speed they need while IT and the business get the control, visibility, security and compliance they need.

Jeff Whitney, VP of Marketing, sat down with Enterprise Management 360 Editor David Tran to discuss trends and issues around person-to-person file sharing within business. 

EM360°: What are you seeing as the key trends today impacting person-to-person file sharing within businesses?

Jeff Whitney: There are essentially three key trends in person-to-person file sharing.

First of all, taking a few steps back, it has only been a few decades ago, in a work world that’s now long forgotten, that IBM mainframes ruled the world. In the good old days, the vast majority of confidential company and customer information was locked down in those mainframe computers. People were only able to access it by wading through computer printouts, or if they were lucky, by accessing large cathode ray VCT terminals. People couldn’t get hold of that information and risk sharing it elsewhere.

But today, the work world is entirely different. Today businesses are dominated with knowledge workers who have personal computers, and each one is far more powerful than those old mainframes. These PCs are filled with confidential company and customer files.

The second trend is that, with all the information that knowledge workers have, they are sending an ever-increasing volume of information to their extended enterprise; to their suppliers, shipping vendors; and their customers and every imaginable type of data being shared including legal documents, patient records, loyalty data, package locations, insurance claims, account information, purchase orders, x-rays, test results, and investment information, just to name a few.

The third trend is, with all of this going on, IT hasn’t been able to keep up with this flow of information, and there is a plethora of easy ways that employees can use to transfer files. For instance: company email, personal email and consumer collaboration systems like Dropbox.  Employees are using these non-secure systems because IT hasn’t been able to provide them with solutions that are convenient enough. They are not knowledgeable of these security risks, and all they want to do is get their work done.

EM360°: From a corporate perspective, what security risks and challenges are therefore in place that management, IT and security professionals need to be aware of?

These file-sharing techniques that employees are using can create security breaches. Even company email is often not secure as it is coming across in an unencrypted way.

You could be breaking corporate compliance obligations — if you are in financial services, in healthcare, or any number of other places who have policies or compliance regulations.

There is a true lack of visibility of Audit trails. You lock down your cash, so you know what is happening to your cash. And yet knowledge is regarded as far more important to businesses, or at least as important as cash. Yet, we are letting that knowledge flow back and forth in very non-secure manners. And the reality is who will get in trouble if that happens — is it the employee who sends it? Definitely. But equally, the senior manager is going to walk into the IT department, asking why IT hasn’t provided their workforce with solutions that can protect secure the data and provide the governance and compliance the business needs. 

EM360°: So now let’s get to the survey. We see your eBook states that 84% of respondents acknowledge they send classified or confidential information as email attachments. That’s astounding. What do you see driving that behavior?

It is really driven by the fact that employees are just trying to get their job done. They are surrounded by solutions — personal email, consumer collaboration tools — that allow them to share information in a very easy to use and rapid form. They carry that over into their work lives. If they know that they could send a file very quickly using a readily available consumer tool, they are not going to wait around for a member of the IT department to help them.

I think it’s actually very appropriate to discuss the magnitude of file-sharing. You mentioned that 84% are using or sending confidential information using these kinds of tools. In that 84%, they are actually sending classified emails with email attachments, which I have reiterated before, is not secure.

Almost three quarters of those — 72% — are doing it weekly, and more than half are doing it every day. This is a major issue.

In fact it gets even worse as employees aren’t using only their work emails, but instead are using their personal email. Some 50% are using their personal emails to send over work attachments. 40% say it’s because it is faster and more convenient. 35% say it is because of file size issues. And 30% say their IT department can’t monitor or audit. They are sending over confidential company information, and for some reason, they do not want IT to monitor that. It’s wrong.

Additionally, 50% are using file sharing websites, and of those, a quarter are doing that weekly, and some of those websites are well known for data breaches and have been publicized for it over the past few months.

EM360°: Jeff, there’s a set of risks in place with most organizations today. So what can companies do to balance the needs of the employee vs. the organization?

What companies need to do is to provide secure managed file transfer capabilities for their employees that they will readily adopt.  These tools need to be convenient, straight-forward, and allow fast transfer of knowledge. And for the business, it needs to provide the security and governance (control, security, compliance) that companies demand. You need to have both; it isn’t just one or the other.

IT isn’t just sitting on resources that are readily available to attack any issue. This issue has just blown up so quickly that IT has been slow to respond. Our survey shows that only 25% of IT organizations actually enforce the usage of IT-sanctioned tools. Only about 40% of organizations have visibility into the movement of their confidential data in and out of their business. And only about 15% receive confirmation of when critical data is being delivered.

As I said, IT organizations haven’t been able to catch up with this trend, and they haven’t provided the solutions that are out there to address this.

So how is Ipswitch File Transfer addressing this increasing need that you’re seeing for secure person-to-person file transfer within organizations?

Ipswitch File Transfer has a long history of providing managed file transfer capabilities for organizations, specifically for IT to manage these issues.

Our MOVEit™ Ad Hoc Transfer solution enables employees to send and receive files and messages between individuals and groups using an Outlook or a simple browser interface.  MOVEit™ meets employees’ needs for convenience, ease-of-use and speed and IT’s need for governance, including control, visibility, security and compliance.

EM360°: Jeff, thank you for sharing your insights with us. The eBook Jeff mentioned is available and includes the full details of the research we have cited around the risks of person-to-person file transfer within business.  

There was a single theme that I heard the loudest and clearest from the security community:

There is growing concern for how employees transfer files in an ad hoc manner to those outside the organization. Employees are quick to turn to DropBox or YouSendIt to step outside of file size limitations or email speed issues, without realizing the consequences of their actions.

We heard this consistently across multiple industries – Retail, Healthcare, Financial Services, Banking, Government, Automotive.

We heard this from organizations large, medium and small with requirements to manage file transfers with partners, customers or vendors, and in some cases with international and global reach.

It was said in different ways but it came down to the security teams seeing significant risk for leakage with their current situation today. Some soundbites:

• “We need a person to person file transfer solution”
• “My users want to send large files through YouSendIt. Right now I just keeping saying ‘No’, I’d rather have a solution to offer them.”
• “We need to support an ad hoc file transfer requirement for our users”
•  “I have people using DropBox today. It is absolutely unacceptable from a security standpoint, but we need to offer them an alternative.”

This risk around person to person file transfer is not going away, it’s getting worse by the day as more and more employees rely on personal email and cloud based services to transfer data. The potential for leakage is amplified when you consider other data transfer devices such  as USB drives and personal email use.

We have done extensive research in this area and we have a Research Report summarized in a graphical eBook which will be published later in October. Titled “Are Your Employees Putting Your Company’s Data at Risk?”, this report helps bring the current problems to life with a picture of how users are behaving today.

Below is an excerpt from the paper, where Michael summarizes some of the key issues with the status quo with personal file sharing within business.  We also invite you to access the full white paper including Michael’s case for why IT needs to provide and manage file sharing solutions.

Excerpted from “Business-Class File Sharing Best Practices”

The Status Quo Doesn’t Work

• Users are stymied because company email systems often do not permit file attachments of more than 10 to 20 megabytes to be sent, and it is not efficient at sending more than a few files at a time. Moreover, email doesn’t typically include a return receipt so the sender can know if the recipient ever received the email. Also, when email is used for file transfer, it imposes increased storage and bandwidth costs, slow message delivery, long backups, long restores, high IT management costs.
• Many users will turn to their personal Webmail account because of their ability to send very large files through these systems. However, when users do so there is no IT visibility into the sent or received content, no tracking, no auditability, and no archiving. Moreover, corporate content can reside in personal Webmail repositories for many years, long after an employee may have left the company. While this makes life easier for users, it increases the risk to the organization.
• USB sticks, tablets and smartphones create the same problems: lack of security, higher costs, their likelihood of being lost or stolen, and the potential for content on them to be accessed by unauthorized parties.
• Dropbox-like file sharing tools and cloud services can be effective, but they do not permit IT management or governance of content. And, they often are individual accounts and not under the sanction of IT which means that IT doesn’t have the visibility or insight into what is being transferred, nor does IT maintain any type of audit trail for this content.
• SharePoint and similar tools are useful for sharing information if both senders and recipients are using it. However, SharePoint require the deployment of a dedicated infrastructure and training for end users, and it is not always easily accessible by remote workers or people external to an organization.
• Basic FTP client-server systems, while useful, require both the sender and recipient to have access to the FTP server to share information, which can be an ongoing provisioning burden for IT.
• Physical delivery of information – such as CD-ROMs or DVD-ROMs that are burned and sent through overnight services – is expensive and the speed of delivery is slow

Again, at this link you can access the full white paper including Michael’s case for why IT needs to provide and manage file sharing solutions.

There is continued increased usage of rogue tools to share files and information when employees don’t have an adequate solution provided to them by their business. These tools include everything from personal email accounts (Gmail, Hotmail, Yahoo!) to cloud-based personal file sharing tools (YouSendIt, DropBox) all the way through to USB drives or what David refers to as “SneakerNet” — walking private data around the office on USB drives which can be easily misplaced or lost.

Michael and David also take a look at what information technology teams can do to deliver solutions to businesses that will address these risks, and tips on how to balance the need for end-user simplicity with the control, security and visibility required by the organization.

1. Make sure it can handle unlimited file sizes.
2. Confirm that minimal training is required to deploy it.
3. Ensure it is secure. This includes utilizing encryption both in motion and at rest, and that the message itself is encrypted too.
4. For successful user adoption, make sure it’s easy to use.
5. Finally, make sure it’s easy to integrate into your existing environment.

For the full discussion between Michael and David as well as the question-and-answer session with the audience, we invite you to view the webinar recording. We also invite you to share this with any colleagues who you think may find it useful.

Consumer-grade solutions such as Dropbox, webmail and USB drives being rapidly adopted in the workplace.  The question is — are they right for you and your organization?

Next Wednesday, on April 25^th, you’re invited to join industry experts Michael Osterman and Ipswitch’s David Boone in a 29-minute rapid-fire discussion where we will address:

• Typical Tools – What are the products employees are bringing with them to work?
• What are the risks of relying on personal file sharing tools in the workplace?
• How can I balance the need of the individual with the requirements of the organization?
• Top 3 things to look for in an easy-to-use and governed business-class file sharing solution?

If you manage an IT environment where these tools are pervasively used by employees to send company information, then you’re encouraged to participate in what should be a very opinionated discussion.  Bring your questions.  Challenge the experts.  Learn how to regain control.  And enjoy the conversation.  Register now.

P.S. – if you are unable to attend the live event, please register anyways and we’ll email you a link to the archived recording for playback on-demand, as your schedule permits.

Talk of security concerns with FTP is certainly not new.  FTP was never designed to provide any type of encryption, making it possible for data to be compromised while in-transit.  A common answer for this is to use encrypted standards-based protocols such as SSL/FTPS and SSH/SFTP.

Luckily, modern managed file transfer solutions deliver not only the security you know your business requires, but also the visibility and control that IT needs to properly govern company information.

Ipswitch’s Greg Faubert offers his thoughts in the Dark Reading article:

“While FTP is a ubiquitous protocol, depending on it as a standard architecture for file exchange is a bad strategy…. The PCI standards look specifically at the security surrounding your FTP environment. It is a significant area of focus for auditors, and they will fail companies in their PCI audits for a lack of adequate controls.”

And yet, somehow, many organizations continue to rely on unencrypted FTP to transport mission-critical or sensitive information.  For those guilty, here are a few steps to help you get started in migrating away from antiquated FTP.  And don’t worry, it won’t be painful.

Quick background on the business need:  Rochester General Hospital needs to exchange patient records, insurance claims, and billing information from their electronic medical record (EMR) and accounting systems with many health providers and insurance companies.

Security and compliance are critically important:  Not only do the transfers need to be reliable to facilitate timely payments, but they also needed to be highly secure and auditable to protect patient privacy and ensure compliance with HIPAA and HITECH.

Ipswitch eliminated complexity and created efficiencies:

“We needed to consolidate on a standard way to transfer files to many different payer systems…. MOVEit consolidated a number of batch files and legacy tools into a single, secure and easy to use file transfer solution,” says Dylan Taft, Systems Engineer at RGH.

“In the event of an audit, MOVEit allows us to provide chain-of-custody and non-repudiation with just a few clicks.  Without MOVEit, we wouldn’t have this visibility.”

If we didn’t have MOVEit, we would have to hire one or two additional people just to review the log files every day – not to mention lost files, information arriving late, and frustrated doctors and payers.”

Do you have a great Ipswitch story of your own to tell?  Email us at mystories@ipswitch.com…. We can’t wait to hear all about it!