As we discussed in the blog on Secure Managed File Transfer and PGP Encryption, using the core components of a total encryption strategy can help you meet compliance requirements, and improve your data security posture!
Hopefully you were able to watch the webinar resource provided (if not, you can request it HERE). After the webinar, we had a number of questions asked by attendees and answered by security expert Patrick Townsend. Here is a recap of that Q&A session:
Q: Is there any reason why I can’t just transfer my file from my IBM i platform to Windows and then PGP encrypt it there.
Patrick: That is a great compliance question. Transferring unencrypted data from your IBM i to a Windows platform and then encrypting it and moving it from there will put you out of compliance for PCI DSS. You should not transfer unprotected data to any system or across any network that’s not fully protected. If you move it from the IBM i platform to Windows platform, it’s going to land in an unencrypted format and that will put you out of compliance. That kind of unprotected transfer will also put you out of best practices alignment in terms of just pure security. The security principle here that comes into play is always encrypt at the source, decrypt at the target or the destination, and don’t let the data be unprotected in-between. Remember, data should never be moved “in the clear”.
Q: Can manage file transfer software be used on just one side, or do all sides of the transfer have to have the same software?
Patrick: Partners/customers would certainly want a managed file transfer solution to be based on open standards. You would not want to install proprietary software to process file transfers and then expect your partners to have to install it as well. We base all of our secure transfer encryption components on open standards like a SSL FTP and Secure Shell sFTP and PGP encryption. This means is that right out-of-the-box you will interoperate with all the major financial institutions and insurance agencies.
Q: Does the Alliance FTP Manager solution run on the IBM i or Windows server?
Patrick: Alliance FTP Manager is a fully native IBM i application. It runs strictly on the IBM i platform and uses industry standard protocols. So there is no proprietary component on Alliance FTP Manager where you would have to distribute special software to someone who is receiving the files in order to process them. We use industry standard pipeline encryption SSL FTP and Secure Shell sFTP. No matter who you’re transferring data to, whether its Windows, Linux, UNIX ,or IBM Mainframe, there are multiple readily available solutions that support those secure file transfer protocols. The commercial PGP that we provide is fully compatible with industry standards, it interoperates seamlessly, and we test it against multiple other PGP solutions as well as open PGP solutions. Your customers and vendors (the people you’re transferring the data to) will appreciate that they do not need special software to process PGP encrypted files or your Alliance FTP Manager transfers.
Q: We occasionally need to create encrypted zip files to transfer files to our customers, can FTP manager do this?
Patrick: We certainly do provide a command based zip file encryption and zip file decryption (compression and decompression) that implements 256-bit AES encryption. It will process with wildcards and so if you have multiple files in an IFS directory you can compress all those into one zip archive. Our directory scan automation component will automatically process data right into your application. So yes, there is an implementation of secure encrypted zip in FTP Manager.
Q: A public/private key pair is needed for SSH and sFTP transfers. Does FTP Manager exchange keys with the destination server?
Patrick: Secure Shell sFTP supports a number of authentication and privacy mechanisms, the most common is using a public and private key pair. You do have to execute a key exchange with your training partner/bank before exchanging encrypted data. We have developed utilities and interactive options to help you load your trading partners public key on the IBM i platform. For example, a menu option will allow you to put in the DNS name for that particular server, then it will find, retrieve, and install that key in your system. Normally these steps are time and labor intensive, but we have automated the exchange to simplify that particular administrative setup function.
Very important: Typically sFTP transfers use public and private keys, just be sure that the solution you choose can also handle password authentication. Alliance FTP Manager CAN do that!
To learn more, view the complete webinar - Secure Managed File Transfer on the IBM I -which examines the security principles, compliance requirements, and technical challenges for secure FTP transfers on the IBM i platform with the following objectives:
If you have further questions, please list them here in the comment section and we will be sure to get you an answer!