Being in compliance is seen as a onetime fix for most companies. As new regulation is passed, companies will make changes to a particular process or buy a piece of software specifically for that regulation, and then continue operating as normal. Most of the time, this decision is based on a cost. Change as little as necessary because anything drastic would cost more. In reality, with regulators imposing huge fines for data breaches and lawsuits ranging in the millions, this is actually a more expensive approach than finding a centralized solution to secure your companies electronic communications.

Ensuring regulatory compliance and data security is as vital to an organization as ensuring that your buildings have electricity. Employees do not worry about the lights turning on at the beginning of each day. The same should be true for electronic security. Employees and customers should not worry about a file being poached or read before it reaches its destination. Securing data in transit, tracking data that is moved within and outside an organization, and ensuring that data is only accessible to those who should be able to read it, are the standards every company should strive to achieve.

This concept is not new. There are companies that have been creating and designing software for over 20 years specifically with this goal in mind. These solutions can typically handle internal and external file transfer, over an array of platforms and protocols, with a centralized administration point. These basic requirements ensure not only data security but the integrity of your business.

Today, most people store their confidential and sensitive information in some sort of digital format, whether it is on their personal system or someplace in the internet “cloud”. Almost all companies have basic cyber-security: anti-virus, anti-spyware, and configured firewalls. These are excellent starts but unless the information is being transferred in a secure manner it is just as available as if you posted to a public forum. Too many companies are using unsecure and unreliable systems, such as FTP, SFTP, etc., to send their confidential information causing major security breaches not only for themselves but for others as well. Not only can the transferred information be read but the transfer can allow access to the server by malicious users. A perfect example of this was reported in February 2008 when San-Jose based Finjan uncovered a database containing more than 8,700 harvested FTP credentials. (Read full article)

I know what you’re thinking, these companies were foolish and my company would never make those mistakes. They were probably all “mom and pop” shops who did not truly understand cyber-security. In reality, the companies on the list included Fortune-level global companies in a wide range of industries, including manufacturing, telecom, media, online retail and IT, as well as numerous government agencies. These security breaches do not just affect you and your company but everyone in the cyber community. Malicious code or unauthorized users gains access to your system based on an open protocol such as FTP, and gains private information. They then use that information to gain access to other “secure” servers and suddenly it has spread, like a virus, affecting thousands of computers.

It does not have to be all doom and gloom. It does not take a lot of effort to ensure that your information is secure and your network is protected. Companies should be constantly re-evaluating their security procedures, ensuring that each step in a file transfer from their internal system to their external partner is secure. They should be ensuring that every connection made can be monitored and verified and that all transfers are encrypted – otherwise you risk the security of your company, your business partners, and your customers.

Take a quick tour on how Proginet is bringing Managed File Transfer to the end user with  Slingshot.

Slingshot allows an end user inside or outside an enterprise to easily send and receive files of any size.  Slingshot integrates seamlessly into MS Outlook so end users have a familiar interface to transfer files.  Also, our Web Browser Application has all the functionality that is in the Outlook Plug-in, so even non Outlook users have the ability to send and receive large files.  All files are sent via HTTPS so you know your attachments are secure with Slingshot.

Join Proginet’s President and CEO, Sandy Weil, in a new ‘At The Whiteboard session’… learn how Slingshot 1.6 new features help solves the major e-mail attachment challenges facing businesses today.

Slingshot is an e-mail attachment management solution that solves the major delivery, storage, and bandwidth challenges of e-mail attachments. The solution is also available as Slingshot Vault, a hardware-based appliance offering full archiving capabilities.

This brings to mind Heartland Payment Systems who suffered a massive data breach earlier this year. Heartland is one of the largest processors of credit and debit card transactions in the U.S. The company handles more than 100 million card transactions per month for 250,000 clients; it’s scary that a company so large could have its systems compromised by intruders for what appears to have been an extended period.

The good news? Heartland announced this week that it will offer its merchants end-to-end encryption capabilities – news that has been roundly applauded by industry analysts. The plans that Heartland announced will protect the company’s processing network with an end-to-end encryption system. Nonetheless, the breach came at a huge financial cost. In Heartland’s first-quarter earnings call last Thursday, company officials said the well-publicized data breach has cost them $12.6 million so far. This amount includes legal costs and fines from Visa and MasterCard, both of which have stated that the payment processor wasn’t compliant with PCI standards at the time of the breach. Visa had taken Heartland off of its preferred payment processor list earlier in March after the breach was made public on January 20. Heartland announced it had been recertified and was reinstated onto Visa’s list of PCI-DSS validated service providers on April 30.

There are lessons to be learned here for other companies transmitting sensitive data – particularly those using non-secure or unmanaged solutions like FTP (note: there’s no evidence that Heartland was using FTP). We’ve had one major customer (a Fortune 500 company in financial services) issue an edict banning the use of FTP anywhere in their enterprise. No ‘ifs’, ‘ands’, or ‘buts’! This is good and should be taken on board by more companies as a corporate best practice. Companies need to act proactively in order to avoid having a data compromise that could literally put them out of business.

About:
John Lynch is Director of Marketing Communications at Proginet Corporation. In this role he oversees the company’s corporate communications initiatives, including press and analyst relations.

I stopped in my tracks right there. Getting data in an out of a mainframe? This was exactly the subject of the article I was working on. It was an uncanny coincidence – but then again, we’re both Pisces with birthdays three days apart.

The Workhorse: Why Mainframes Won’t Go Away

The much-heralded death of the mainframe never happened. Mainframes have remained hugely important in the corporate and public sectors because they are secure, scalable, reliable, and efficient. They tend to be the workhorse of many Global 1000 companies.

But these workhorses need to coexist. In an increasingly distributed world, mainframes must coexist with the range of platforms in an organization (Windows, Linux, UNIX, AS/400, etc.).

Beyond Messaging: Achieving Integration on the Mainframe

So how do organizations go about tying their mainframe in to their distributed platforms? Two of the most common methods, ironically, are FTP and messaging. But both have limitations. FTP is weak from a compliance and security perspective. It also lacks automation capabilities, doesn’t scale well, and lacks key functionalities including tracking and auditability. Messaging, as anyone in a mainframe shop know, is a very good technology that serves organizations well. But it’s not designed to move large chunks of data. It’s transaction-based by its very nature and cannot handle the large files or volumes of data that are becoming the norm in most organizations (particularly with regard to the batch-oriented systems found in many mainframe environments).

Many organizations are electing to deploy advanced managed file transfer (MFT) solutions so that they can holistically rationalize all of their file transfer processes. Bringing everything together under a common umbrella makes complete sense. Some companies think of it as ‘modernizing’ their file transfers. MFT certainly helps drive security, automation, control, and management, but one of the key drivers will continue to be integration. In an integration scenario, MFT technology becomes the workhorse – doing the ‘heavy lifting’ required in batch-oriented systems. As such, MFT has become a key integration technology that can and should co-exist right alongside your organization’s messaging technology.

– John

About:
John Lynch is Director of Marketing Communications at Proginet Corporation. In this role he oversees the company’s corporate communications initiatives, including press and analyst relations.

Join Proginet’s President and CEO, Sandy Weil, in our new ‘At The Whiteboard series’  Proginet’s CFI Edge Server is an appliance-based proxy server that provides a secure gateway for transferring  files across the Demilitarized Zone (DMZ) in your network.

“File transfer multicasting.” That’s how Proginet’s President and CEO, Sandy Weil, describes CFI with RocketStream, the Company’s innovative new solution for accelerated managed file transfer. CFI with RocketStream turbocharges global file transfers – delivering files up to 30 times faster than FTP and commercially available file transfer applications. CFI with RocketStream achieves these speeds by defeating network latency; global organizations transferring large files over high-latency pipes and long distances will yield maximum benefits.

Standards based file transfer protocols such as FTP and FTPS are good for certain types of transactions but miss a key capability required for mission critical business functions. That capability is guaranteed delivery.

Guaranteed delivery is a critical requirement for businesses today. One of the biggest problems companies have when using FTP – or other, older file transfer protocols – is that there is no way to truly guarantee that the data is delivered to the remote system. These protocols lack the necessary capabilities to effectively identify if a transfer is interrupted during transmission.

Most managed file transfer (MFT) solutions have the option to leverage a proprietary protocol between their components. Among other things, this adds capabilities such as built in guaranteed delivery and automated exception management. These capabilities are supported by standard MFT features which include:

Data Validation: Proprietary protocols are designed to ensure reliable file transfer. Typically, the protocol has an initial handshake which includes information about what file is to be transferred and how it is transferred. Once the transfer initiates, the standard CRC (cyclic redundancy check) is performed on a packet-by-packet basis to ensure that there is no data corruption during transmission. At the end of the transfer, a final handshake is performed where details of the transmission (number of packets, etc.) are exchanged. This gives both sides an opportunity to notify the other if any problems have been encountered during the transfer (the protocol also allows for either side to notify of issues encountered during the transfer as well). By taking this approach, MFT solutions are able to ensure that files are delivered in their entirety with no data corruption. In the event that there is an error, both sides in the transmission are immediately made aware of the error.

Checkpoint Restart: Checkpoint Restart, when enabled, periodically sends control packets within the file transfer. This informs the receiver of the current point within the file. The receiver commits the latest data received to the file system and records the sender’s checkpoint and its own checkpoint in persistent storage. In the event that a link connecting two machines goes down during a transfer, or the transfer fails due to a recoverable error, the system will automatically restart the transfer from the point of failure; transfers are not required to start from the beginning. This is critical when transferring very large files (multi-gigabytes or even terabytes), and can save a tremendous amount of time and network bandwidth.

Recoverable Work Queue: Recoverable work queues ensure that all queued transactions are retained in the event that the system comes down for any reason. If the system comes down (e.g., a machine loses power), all transactions will still be in the work queue when it is brought back up.
Automatic Retries: If a transmission is not successful, it is placed back in the queue and automatically retried at the pre-configured interval (set by the administrator). No human intervention is required for the retransmission. If the error condition is determined to be a permanent error, the system will send notification to an administrator. This enables the administrator to correct the error in order that the transmission can complete successfully.

Businesses Need Something They Can Depend On

Solutions that rely solely on open protocols like FTP simply can’t match the levels of reliability and automation available from an MFT solution that leverages a proprietary protocol. To compensate for this, some organizations will have their developers write scripts and applications around the open protocol to help overcome its shortcomings. This is an unrealistic approach in the medium- to long-term. The organization is forced to waste valuable development resources coming up with a solution that is neither flexible nor reliable. Added to that, if your developers leave the organization, you are left with a highly-customized application that is difficult to maintain.
My position is that FTP can’t cut it at the corporate level. Companies that can control both sides of a connection are better off leveraging an MFT solution that offers guaranteed delivery right out-of-the-box.
-Kevin

About:
Kevin Bohan is Chief Information Officer at Proginet and has more than 20 years experience in international MFT best practices.

Fast forward to present day … for the most part, we’re making more concerted efforts to go green. There are mainstream films focused on environmental issues chronicling how we have damaged our planet, such as: An Inconvenient Truth, the 11^th Hour and Erin Brokovich. Auto manufacturers have created hybrid cars, and demand seems to be growing. Car pooling is not just for children en route to elementary school, but is encouraged for adults heading to work. There are recycling facilities everywhere. We now know that there are products to clean our households that are deemed as environmentally safe and friendly. There is greater awareness of what we should be doing, and how we should be conducting ourselves in a more environmentally conscious manner. We’re certainly trying. But, is this new found sense of urgency enough? And, what about the place where we spend most of time – the office?!

Well, maybe, maybe not. I know of people who have to bring home cans and bottles to make sure that they are placed in recycle bins. They have to do this because there are no designated bins at their offices. On the other hand, I do receive e-mails from friends and colleagues with the following in green at the bottom: “Please consider the environment before printing this e-mail.” I have obviously seen changes in the methods employed to send documentation. More and more data is being transmitted electronically. Rather than sending CDs of information or hard copies of reports via traditional mail or courier service, files are being transferred securely online. This should lead to a reduction in the use of fuel, and fewer emissions of hazardous gases like Carbon Dioxide and Carbon Monoxide. The sending of faxes has also lessened with electronic transmission. But, paper is still being thrown away and there are resources being wasted. Lights are often left on when no one is in any given office. Even with utilization of technology and our willingness to take more responsibility, there are constant problems and persistent issues.

So, what can we do to really make things better… to try to save this planet of ours? Is your company environmentally sound, and using their technological ingenuity to be more green? If so, please let me know (amanda.bleich@proginet.com). And, lastly, please think of the environment before printing this blog.