Secure file transfers

Question

We are using a custom FTP application (which encrypts the files) for secure transfers. We send the application to end users and they use it to send us confidential data. We also use it to send information back to the end users.

The application is in need of an update - some things are no longer working consistently. As the end users get more restrictive security environments, as OS updates are released, etc.

We have several options:

1. Update the application, use SFTP, etc.
2. Write a new custom web application to add to our aspx website.
3. Purchase or download SFTP software
4. Purchase or download web software
5. Setup an external sharepoint site
6. Use a service which is hosted elsewhere - preferably in Canada so that our laws apply

Some of features which would be nice:

1. We would not want decrypted files sitting on a server outside the firewall.
2. Resumable transfers.
3. Ability to move the files automatically to a specific place inside our firewall. Though this could be easily done outside the file transfer.
4. Notifications for both sender and recipient by email.

Suggestions/comments?

Answer 1

First, FTP is a plaintext protocol, so it's already not secure. Your updated description is helpful on this count :)

Running SFTP is pretty easy - by deafult it's running when OpenSSH is installed and running. (Yes, they need a login, but that's simple enough to handle - especially with an LDAP tie-in.)

Running over HTTPS may be worthwhile. Sharpoint, Plone, and myriad other CMSes come to mind.

Answer 2

I've had good results using Free SSHd on windows machines; it runs on the standard SSH port (22), supports SFTP, and is encrypted end to end. It also lets you set up authorization systems in parallel with your windows permissions, so you can exercise pretty fine-grained control of who gets access and what they can do.

Answer 3

Definitely write a file upload web application and add it to your existing website. This gives you the flexibility to create the exact solution you and your clients need, but more importantly, it eliminates this problem from happening in the future. With a web app, there are no client applications to update, distribute, or support. You control the entire process.

A file upload app for ASP can be found easily on the internet, pick one that best suits your needs and customize it:

http://www.google.com/search?q=aspx+file+upload&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a

Be sure to configure your webserver to use HTTPS and not allow HTTP to ensure the files are encrypted during transport