We have a number of various FTP processes, running on various internal servers, that connect with outside vendors to send or receive sensitive data files. As such, we don't have one centralized place to keep track of these processes and log what files are being transferred. At the same time, we're worried about staff sending unapproved files to outside organizations without us knowing about it. And for those vendors that push files to us, we'd prefer in the future that they not be allowed into our network, even if solely via FTP. To address these concerns, we're considering a solution with two primary goals:
- Centralize all FTP transmissions so that they are all handled from one place that is easily monitored.
- Block all ports in our firewall that allow FTP and SFTP communication.
This is what we are planning: we'll put an SFTP server in our DMZ to interact with our vendors, so that they never need to go through our firewall in the future. Then, we'd have a web service set up on both the DMZ and an internal server that will send the files to each other through our firewall over TCP/IP using SSL.
I'd like others' thoughts on this idea, namely:
- Is this idea feasible and secure? Or is there a flaw in it that may be giving us a false sense of security?
- Are there any software packages out there that you would recommend to do this, to save us the trouble of coding a solution ourselves?
This is adding a great deal of complexity to the concept of a simple file transfer, so I want to make sure our design is solid before we begin down this path.