No More FTP Eliminate FTP and Email Attachment Issues with Proofpoint Secure File Transfer

No More FTP Eliminate FTP and Email Attachment Issues with Proofpoint Secure File Transfer Proofpoint Secure File Transfer: A secure, compliant and easyto-use solution for transmitting large files Proofpoint, Inc. 892 Ross Drive Sunnyvale, CA 94089 P 408 517 4710 F 408 517 4711 info@proofpoint.com www.proofpoint.com

Proofpoint s solution for secure transmission has been developed to provide a compliant, easy-to-use and easy-to-manage alternative to traditional file transfer techniques including FTP and email attachments. Deploying Proofpoint Secure File Transfer as part of your Proofpoint deployment can help you eliminate the need for FTP servers, improve the performance of your email systems, reduce storage requirements, and create compliant business processes.

Contents Overview...1 The Growing Need to Send Large Files...1 Why FTP Falls Short For Today s Business Requirements...1 Lack of security is the most dangerous shortcoming of FTP...2 FTP account set up is time consuming for IT...2 File management on FTP servers is an administrative burden...2 FTP is not a good collaboration tool...2 FTP does not meet compliance requirements...2 An FTP Alternative: Proofpoint Secure File Transfer...3 Enabling the secure sharing of any size file...3 Eliminating administrative burdens...3 Managing digital assets...3 Enabling compliant processes...3 Providing operational efficiencies...3 Table 1: Comparison of File Transfer Methods...4 Compliant File Transfer Applications...5 Table 2: US regulations regarding data permanence, security, privacy and traceability...5 Proofpoint Secure File Transfer Components...6 Proofpoint Secure File Transfer Appliance or Virtual Appliance...6 Web-based User Interface and Email Client Plug-in...6 Proofpoint Administrative Interface...7 Benefits of Using Proofpoint Secure File Transfer...7 For Further Reading...8 Outbound Email and Data Loss Prevention in Today s Enterprise, 2008...8 Regulations Shift Focus on Outbound Email Security...8 Email Confidential: Are Your Secrets Safe?...8 Best Practices in Messaging Security...8 Encryption Made Easy...8 About Proofpoint, Inc...8 Contents

Page ii

Overview Today s business environment requires ad hoc and instantaneous sharing of information. Systems for sending large files have not kept pace with the needs of today s enterprise, where increasingly large and sophisticated business documents, files and media need to be quickly transmitted and shared with coworkers, business partners and customers around the world. Existing solutions for sending large files fall short in several regards: Email does not handle large files (even just 10MB) efficiently and FTP is too difficult to manage, administer and use. End users often resort to time-consuming workarounds such as burning CDs and sending them via overnight mail or to using unapproved (and uncontrolled) technology solutions such as thirdparty file transfer services or instant messaging. More seriously, FTP and CD sending do not meet the stringent tracking and audibility requirements of business processes that must comply with government and industry mandates such as Sarbanes-Oxley Section 404, FDA 21 CFR Part 11, and HIPAA. Proofpoint s solution for secure transmission of large or sensitive files, Proofpoint Secure File Transfer, has been developed to provide a compliant, easy-to-use and easy-to-manage system to send large files. Deploying Proofpoint Secure File Transfer as part of your Proofpoint deployment can help you eliminate the need for FTP servers, improve the performance of your email systems, reduce storage requirements, and create compliant business processes. The Growing Need to Send Large Files Today s business environment is changing more rapidly than ever before. Globalization and increased competition are driving new business models and collaboration needs. For example, outsourcing is creating new demands to synchronize business processes across companies and increase the sharing of information. Another example is the always on, distributed company that has to make faster decisions, which requires more information to be available and shared more broadly. Business users are demanding new tools for instantaneous ad hoc communication and data transfer. Information and how we share it has evolved as well. Five years ago, most people would use email to share spreadsheets and PowerPoint presentations. For other data sharing, they typically relied on custom systems. Today, presentations and spreadsheets are much bigger and are used much more broadly. In addition, application files and sometimes even whole databases are regularly shared as part of new business processes. Examples of large files that are routinely sent today include closing documents for complex financial transactions, design documents for engineering firms, research databases for pharmaceutical companies, and video files for advertising and media firms. Many of these files are so big that email cannot reasonably be used to deliver them. Finally, many business processes have changed so rapidly that the supporting IT systems are out of sync with the businesses they support. While people used to rely on corporate systems to integrate a company, we are now seeing much more data being shared outside the formal IT systems, using alternative or non-standard solutions. While some organizations have resorted to more cumbersome and costly solutions, such as CD burning and overnight mail, most companies need to move at electronic speed and are using a very unlikely tool to send their data: FTP. Why FTP Falls Short For Today s Business Requirements FTP, or File Transfer Protocol, was one of the first protocols developed for the Internet back in 1973. FTP was developed so that people could share files between computers on the Internet. It was designed by programmers to share files with other programmers with the usage metaphor of manually copying files through a command line interface. It rapidly became a ubiquitous programmer tool but it is very unlikely that it would ever have become a business tool had there existed reasonable alternatives. When FTP is used in a business environment it is typically implemented as follows: An FTP administrator creates one or more FTP directories where files that need to be shared are put. People who want access to these files are granted access to one or all of these directories. Recipients (or downloaders) download files through a browser from the directories they have access to. Page 1

For business collaboration, FTP is often unfamiliar, inconvenient, and difficult to fit into the normal work flow. However, FTP falls short as a scalable business application in several other areas that are more serious and more costly than the issue of inconvenienced business users. Enterprises Concerns about FTP Enterprise IT professionals are rightly worried about the risks associated with FTP. In its March 2008 survey of more than 300 email decision makers in large enterprises, Proofpoint found that 41% of respondents are concerned or very concerned about FTP as a potential conduit for the exposure of confidential or private information. Traditional Email Attachments are not the Answer, Either As you ve undoubtably noticed, large email attachments are clogging up email servers. Emailing file attachments larger than 10MB is no longer feasible in most organizations. Incredible really, given that email is the de facto standard for enterprise communication and collaboration and that as email usage has increased exponentially, so has the size and volume of email file attachments. The problem that many businesses are discovering is that email was not designed to act as a primary file transfer server for large file attachments. These large files can, and do, quickly congest the entire email network, slow down productivity, and leave businesses exposed to severe security risks. One large file attachment can cause an enterprise email network to slow down. Even a mediumsized file sent to a large distribution list can disrupt email and other critical enterprise applications. In the worst case scenario, email servers have been known to crash from extreme workload. Lack of security is the most dangerous shortcoming of FTP When FTP was designed, the security environment was much more benign. Now, with the need for greater controls and tracking of digital assets, FTP represents a security risk for most companies. Security and control have become the responsibility of the over-taxed IT administrator, who must minimize file exposure to the wrong parties, delete files, setup and manage accounts, maintain complex file directories, and securely distribute passwords. Frequently, the system breaks: passwords are shared amongst multiple users, files are left for months in FTP directories and confidential documents may be exposed. Many of the security vulnerabilities have been alleviated with new flavors of FTP (e.g., SFTP, FTPS, EFTP) which typically require that special client programs be installed on users computers. However, requiring ad-hoc recipients to install a program for file delivery imposes a time consuming overhead, which limits adoption. FTP account set up is time consuming for IT An FTP system account has to be created for both uploaders and downloaders. Waiting for this to happen is frustrating for business users who may have an immediate need to transmit a large file. Apart from administration overhead, this causes further security issues because users start sharing accounts and passwords and outside recipients have login access to a computer behind the corporate firewall. File management on FTP servers is an administrative burden Over time, FTP directories tend to fill up as users upload more files. Unfortunately, the people who upload files rarely remove them. The result is directories of hundreds of large files and little knowledge as to which files should be deleted. The FTP administrator will likely guess based on file name, type and date, with somewhat unpredictable results and potentially upset users. Because of the lack of automatic cleanup of files in FTP, valuable digital assets are frequently left unprotected in an FTP directory for extended periods. FTP is not a good collaboration tool The usage metaphor of FTP is quite different from email, the standard ad hoc collaboration tool for business. Users have to download a file when they believe that a new version has been uploaded. The uploader will not know when someone downloads a file. There is very little ad hoc about FTP because of the account setup structure. From a user perspective, the preferred way to send a large file is as an email attachment. However, because of the burden on the email infrastructure (specifically storage and server performance), large attachments are often prohibited on many email systems, forcing FTP on end users and IT. FTP does not meet compliance requirements Data protection and corporate governance regulations such as HIPAA, FDA 21 CFR Part 11 and Sarbanes-Oxley, require that companies prove that the intended information and only the intended information was shared or exchanged (HIPAA); administrative controls are in place when electronic systems and records are used in place of paper or manual systems (FDA); and that business processes have integrity and are auditable (Sarbanes-Oxley). In these environments, FTP does not have the required control capabilities. The only way companies can prove that data deliveries took place is if the delivery system keeps records of all transactions and that these records can be retrieved later. But FTP doesn t keep records of each download. This makes sense: FTP was designed to be an open protocol for programmers to share files and not to be an auditable business tool. Still, business processes that routinely rely on FTP to deliver information or other digital assets are not auditable and are not compliant. And although FTP is free, when the above factors are taken into account, the cost is clearly significant and the possible risks even more costly. This has lead to some organizations developing their own applications, but this approach is hard to maintain and to scale with the business usage needs of both internal and external users. Page 2

So, what compliant, secure, and effective alternatives are there to FTP? An FTP Alternative: Proofpoint Secure File Transfer Until now, the few alternatives to sharing large files have not been easy to use or deploy, nor suitable for meeting widespread requirements for security, scalability, usability, and maintenance. The ideal file transfer system needs to have the following characteristics: o Auditability and traceability: This can be considered one of the key drivers of a better file transfer system. Government regulations now demand that companies have in place auditable business processes. Large file sharing is often part of critical business processes. See Table 2 (page 5) for a list of major compliance regulations. o Security: Large files often represent digital assets that need to be managed securely rather than being sent out in the open. FTP is insecure by design, with no encryption or secure channels for upload or download. o Easy management and maintenance: The ease with which a system can be managed and maintained greatly impacts that system s total cost of ownership. o Efficiency: Although bandwidth and storage may be getting cheaper, the management costs related to storage and bandwidth can be several times the original purchase cost. Given the exponential increase in file size and the need to share more and more versions of these files with more and more people, any file transfer system must be able to automatically make optimal use of available storage and bandwidth without administrator intervention. Proofpoint Secure File Transfer has been developed to meet the need for easier to use, easier to maintain, and more secure large file sharing. Proofpoint Secure File Transfer is easy to use and requires nearly zero administration for IT. This system addresses the limitations of FTP by: Enabling the secure sharing of any size file Proofpoint Secure File Transfer gives business users an easy and intuitive way to send documents of up to 20 Gigabytes to both internal and external recipients. All data transfers use secure channels. Senders receive a download receipt whenever a file is downloaded. Eliminating administrative burdens Users send files through a web interface, or via regular email (using a plug-in for Microsoft Outlook) as easily as sending an email with an attachment. The recipient receives an email with a link to the file and downloads the file by simply clicking on a link provided in the message. Optionally, the system allows external recipients to self-register, enabling them to send files back to the originating organization. This eliminates the need to have system accounts laboriously setup, monitored, and deleted for both sender and recipient. Managing digital assets Any file sent and downloaded is tracked, the sender receives a download receipt, and files can be automatically deleted or archived after a system-configurable length of time. The only way files can be accessed is through the embedded email links. Enabling compliant processes Because of the secure and auditable design of Proofpoint Secure File Transfer, it can be part of business processes that comply with many types of data protection, privacy and corporate governance regulations. The next section highlights some of the regulatory requirements that the system supports. Providing operational efficiencies Proofpoint Secure File Transfer optimizes both storage and bandwidth. Any type of storage NAS, SAN, offline, etc. can be integrated with the Proofpoint Secure File Transfer appliance for long term archival. Automated retention and deletion rules can be put in place that make the system self-managing. The system is able to fill available bandwidth, such as point-to-point lines, for maximum speed of transfer. It enables optimum service levels because spikes for sending large files are smoothed and files can be prioritized for sending. Furthermore, the sys- Email Storage Issues with Enterprise File Transfer The popularity and pervasiveness of email has created a very serious problem for organizations of all sizes. As the sophistication and size of attachments carried in email have grown, the number of problems for IT administrator and users alike has grown. Large attachments sent through email can dramatically drive up storage costs and also reduce the performance of messaging servers. You can t get there from here Exchanging large files has become a core business process for most organizations, and telling end users You can t get there from here is not an adequate answer to what to do with large files. Email servers and email client software are not designed to handle large files and, in most organizations, sending and receiving email attachments is typically limited to files less than 5-10 MB in size. Proofpoint Secure File Transfer enables both internal and external users to send large file attachments regardless of the email attachment limits your organization enforces. Mailbox Quotas and Attachment Policy Backlash The response from most IT departments to the problems of email file transfer has been to implement quotas on the size of mailboxes and/or limitations on the size of attachments that can be sent through email. While such policies are essential for keeping email systems running smoothly, they don t actually solve the problem of how to send large file attachments over an enterprise network. In reality, imposing mailbox quotas has resulted in users spending more time managing their mailbox sizes and many are tempted to circumvent IT-imposed limits through the use of personal Webmail accounts, online file transfer services and IM. Page 3

None of these approaches represents a scalable, auditable way to send large files securely from within the company. In many cases, mailbox quotas and attachment size limits results in normally rule-abiding employees bypassing corporate messaging security defenses to send files outside their enterprise infrastructure. Proofpoint Solves the Problems Associated with Large Email Attachments By deploying Proofpoint Secure File Transfer, companies are able to offload file attachments from the email server, preserving network performance and equally importantly enabling end users to securely exchange large files. End the Administrative Burdens Related to Email Attachments Proofpoint Secure File Transfer allows internal and external users to send and receive files and folders without adding IT administrative overhead or infrastructure burden. With Proofpoint, IT has a solution that enables users to send large file attachments without clogging email servers and slowing down the messaging infrastructure. End users appreciate the solution too, because it uses a familiar email interface. Using Proofpoint Secure File Transfer, end users still send an email, but instead of the file being attached and sent through the email system, the file is automatically uploaded to a Proofpoint appliance. Recipients download the file by clicking on a secure link sent along with the email message. tem can be configured to be redundant with failover capability and is able to scale seamlessly as the business need grows. Table 1: Comparison of File Transfer Methods Key Features Business Suitable for ad-hoc file delivery Administration Account creation and deletion File deletion or expiration Reporting and visibility Security Transport Layer Security Virus scanner integration FTP Newer FTP (SFTP, FTPS, EFTP) Email Attachments No No Yes Yes Proofpoint Secure File Transfer Manual Manual Automatic Automatic Manual Manual Manual (shifts the problem to mail server) Automatic Log files Varies Difficult Clear and simple None Varies None Yes (SSL) Cumbersome Cumbersome Easy Easy Login Security No Yes Depends Yes End User Impact Desktop client installation Send/receive very large files Zero impact on mailbox storage limits Accounts can be created without administrator intervention Recipient receipt notification Not required (browser) Required Not required Not required (browser or optional plug-in) Yes Yes No Yes Yes Yes No Yes No No Yes Yes No No No Yes Page 4

Compliant File Transfer Applications There are numerous regulations where Proofpoint Secure File Transfer can aid in compliance. The table below summarizes several U.S. regulations that address data permanence, data security, data privacy, and data traceability. Proofpoint Secure File Transfer can support a compliant business process in these areas: Table 2: US regulations regarding data permanence, security, privacy and traceability Legislation Vertical Segment Requirement Impact Sarbanes-Oxley (SOX) Industry-wide Act, Section 404 Health Insurance Portability and Accountability Act (HIPAA) Healthcare, others Requires public companies to verify that their financial-reporting systems have the proper controls, such as ensuring that revenue is recognized correctly. Requires testing and monitoring of internal controls via establishing, documenting, and auditing business processes. Addresses security policies and procedures of insurance companies and providers regarding personal health information and services. 21 CFR Part 11 Life Sciences Regulates life science and pharmaceutical companies involved in biotechnology and manufacture of medical equipment, food, and beverage concerning electronic and paper record retention. Department of Defense (DOD) 5015.2 Securities and Exchange (SEC) Act Rules 17a-3 4 (17 CFR 240,17a-3,4) Government Financial Services Concerns all defenserelated government agencies and contractors use of technologies relating to records. Requires broker retention of sent and received communication, including interoffice memos, emails, sales training manuals, advertisements, and account records Audit trails, authenticity, record retention Record retention, privacy, protection, service trails Record retention, authenticity, confidentiality, audit trails Authenticity, protection, secure shredding Protection, audit trails Record retention, authenticity Page 5

Proofpoint Secure File Transfer Components Proofpoint has the premiere appliance-based secure file transfer solution on the market today. Proofpoint s enterprise solution is cost-effective, auditable, secure, and easy-to-use for both business users and IT administrators. Figure 1 illustrates the simple process by which files can be sent and received. When a business user needs to send a large or sensitive file, they use the Proofpoint Secure File Transfer web interface or email client plug-in to compose an email and attach the files they need to transmit. Instead of being sent as an email attachment, the files are automatically uploaded to the Proofpoint Secure File Transfer appliance. The recipient is sent an email containing a secure link to the file. The recipient clicks on the secure link to download the file from the Proofpoint appliance. Sender Create Email Attach Files Files Delivered Securely via Proofpoint Secure File Transfer Retrieve Files from Appliance Recipient Download Files Click Secure Link Hit Send Files Uploaded to Appliance Review Valid Email Email Sent with Secure Link Figure 1: How Proofpoint Secure File Transfer works Proofpoint s secure file transmission solution consists of the following components. Powered by Proven, Enterprise File Transfer Technology Proofpoint Secure File Transfer is powered by Accellion File Technology. Proofpoint Secure File Transfer Appliance or Virtual Appliance The Proofpoint Secure File Transfer appliance (available in both hardware appliance and virtual appliance form factors) is used to temporarily store large files as they are being transferred. Proofpoint Secure File Transfer appliances can be deployed as a single site installation with a single Proofpoint appliance or, in an enterprise installation, multiple appliances can installed in different geographic locations to provide a secure file transfer network. The Proofpoint appliance is installed in the DMZ for delivering attachments to external recipients. Proofpoint Secure File Transfer requires minimal ongoing maintenance because the operating system and software are maintained automatically, so issues with operating system compatibility do not exist. The appliance is available in multiple models to fit the capacity needs of any size enterprise. Web-based User Interface and Email Client Plug-in Proofpoint users have the choice of sending a large file via the Proofpoint Secure File Transfer web interface or using the Proofpoint Secure File Transfer plug-in for Microsoft Outlook. Using either interface, the business user composes an email to the intended recipient and attaches the file. When the email is sent, the file is not included in the email. Instead, a secure link to the file is included. The attached file is instead sent to the Proofpoint appliance. The recipient clicks on the link in the email and downloads the file from the Proofpoint appliance. Page 6

Proofpoint Administrative Interface Initial setup and ongoing administration are accomplished through an easy-to-use, Web-based administrative interface. Appliances can be managed remotely through a standard Web browser. Administrators can easily configure flexible file replication and retention policies, based on the parameters such as the amount of time files should be stored, the type of file, user groups and other parameters. Statistics and usage can be reported for a particular appliance or a network of appliances. Chargeback grids can also be established to bill clients or internal departments for metered usage of the secure file transfer system. Benefits of Using Proofpoint Secure File Transfer Proofpoint Secure File Transfer sends large files outside the email infrastructure, alleviating the storage, security and cost burdens that such files place on the email system. Yet Proofpoint s solution provides all of the convenience of email for both senders and recipients. Senders initiate a file transfer using already familiar Web or plug-in interfaces. Recipients receive an email message with an embedded, secure link. Any business process that incorporates the transfer of large files and needs to verify authenticity, maintain an audit trail, and retain a record of file transfer will benefit from incorporating Proofpoint Secure File Transfer. Because the system is easy to use for both senders and recipients, it can be integrated into any compliant business process to ensure that a file, document or any other digital asset has been (1) delivered to the intended recipient at the intended time, and (2) deleted or archived for the required time. Because the email does not include the file as an attachment, the email is very small and will not be blocked by any size restrictions on recipient s email system. When the recipient receives the email and clicks on the embedded link, the file is downloaded from the Proofpoint appliance securely using SSL. The file transfer is secure and compressed for optimal performance and bandwidth utilization. The most important feature, from a compliance perspective, is the fact that the Proofpoint Secure File Transfer system keeps records of all downloads. Return receipts are also sent to senders every time a file is downloaded so they can ensure receipt of files without having to consult a system administrator. Unlike FTP, Proofpoint s appliance-based file transfer solution is easy to manage. Account creation and maintenance is greatly simplified with Proofpoint. With LDAP/AD integration, users of Proofpoint file transfer can make use of existing network accounts and passwords. Recipients of files sent via Proofpoint Secure File Transfer can also voluntarily register as restricted senders and can send files back to the sender, without IT intervention. With the elimination of FTP, file management is no longer IT-support intensive. Proofpoint Secure File Transfer can automatically remove files and expire file links when their availability timeframe has expired. Page 7

For Further Reading Proofpoint offers a variety of free educational whitepapers that further describe the risks associated with outbound email and the policies, processes and technologies that can be used to reduce those risks. Visit our online resource center at http://www.proofpoint.com/resources for the latest information. Outbound Email and Data Loss Prevention in Today s Enterprise, 2008 Proofpoint s annual survey of email desicion makers in large enteprises uncovers the surprising facts about enterprise concerns about outbound messaging, the frequency of data loss incidents in the enterprise and the techniques and technologies used to mitigate the threats associated with outbound email and other messaging technologies. http://www.proofpoint.com/outbound Regulations Shift Focus on Outbound Email Security Discusses the impact of relatively new data protection regulations and standards such as the Payment Card Industry (PCI) Data Security Standard (DSS) and the Office of Management and Budget (OMB) Personally Identifiable Information Guidelines (PIIG), which place new constraints on how data is stored, processed, and transmitted over email: http://www.proofpoint.com/regulationswp Email Confidential: Are Your Secrets Safe? Discusses the financial and legal risks associated with leaks of confidential information and valuable intellectual property and outlines a process for implementing and enforcing policies that can keep valuable information secure: http://www.proofpoint.com/confidential Best Practices in Messaging Security Discusses the increasing number of healthcare and financial privacy regulations and how they impact email systems: http://www.proofpoint.com/regulatory 2008 Proofpoint, Inc. All rights reserved. Proofpoint, Proofpoint Secure File Transfer, Proofpoint Protection Server, Proofpoint Messaging Security Gateway, Proofpoint on Demand, Proofpoint MLX, Proofpoint Content Compliance, Proofpoint Regulatory Compliance, Proofpoint Network Content Sentry, Proofpoint Secure Messaging and Proofpoint Digital Asset Security are trademarks or registered trademarks of Proofpoint, Inc. in the US and other countries. Portions of this document are copyright Accellion, Inc. and are used by permission. Version 05/08 - Rev A For More Information Proofpoint, Inc. US 892 Ross Drive Sunnyvale, CA 94089 USA P 408 517 4710 F 408 517 4711 E info@proofpoint.com www.proofpoint.com Encryption Made Easy Discusses the development of encrypted messaging systems and the unique advantages of Proofpoint s secure messaging solution: http://www.proofpoint.com/encryptionwp About Proofpoint, Inc. Proofpoint provides unified email security and data loss prevention solutions for enterprises, universities, government organizations and ISPs to defend against inbound threats such as spam and viruses, prevent leaks of confidential and private information across all protocols, and encrypt sensitive emails. Proofpoint s products are controlled by a single management and policy console and are powered by Proofpoint MLX technology, an advanced machine learning system developed by Proofpoint scientists and engineers. Proofpoint, Inc. EMEA The Oxford Science Park, Magdalen Centre Robert Robinson Avenue Oxford, UK OX4 4GA T +44 (0) 1865 784808 F +44 (0) 1865 784809 E info@proofpoint.com www.proofpoint.com Proofpoint, Inc. APAC 56 Berry Street North Sydney NSW 2060 Australia P +61 02 9455 0289 F +61 02 9455 0001 E info@proofpoint.com www.proofpoint.com Proofpoint Japan K.K. 906 BUREX Kojimachi Kojimachi 3-5-2, Chiyoda-ku Tokyo, 102-0083 Japan P +81 3 5210 3611 F +81 3 5210 3615 E sales-japan@proofpoint.com www.proofpoint.co.jp Page 8