We are supposed to be implementing a file-transfer solution between us and a third-party, which uses a dedicated private line between us and them, and FTPS (i.e. FTP over SSL/TLS) to transfer files.

However, I am reading through the current iteration of the specification, and have discovered the following paragraph:

The communications channel will consist of an encrypted and authenticated session between your and our PEP devices. This session will use the TLS v1.1 protocol standard (RFC4346) and will make use of mutual authentication using PKCS #3 Ephemeral Diffie Hellman key exchange to generate a shared secret.

When I first saw this, I thought it was describing the TLS used by the FTPS connection. However, now I'm not so sure. The above infers some sort of additional tunnelled communication: i.e. FTPS, over a TLS tunnel(?), itself over a dedicated line -- possibly some sort of SSL-based VPN.

I seem to be missing a piece of the puzzle here, with regards to the PEP. The specification document's glossary defines this as a Policy Enforcement Point but, from a practical standpoint, I can't even claim to know what this is. In any case, I doubt I currently have one.

I've got the following components in place:

  1. A Windows Server, where I was intending to install the FTPS server component (IIS 7.5), an FTPS client library, and bespoke software to move the files around

  2. A Cisco ASA firewall, which is separating the server from the ADSL router that has been put in to provide the dedicated line.

  3. A PCI-card hardware security module, installed in the Windows server, which stores the private keys for FTPS server certificate (and, presumably, the key for the certificate that backs this PEP/TLS connection).

What is the PEP, and where does the it fit into this scenario?

Is there a service that I should be looking at installing, to establish this tunnelled connection?

(I thought maybe an SSTP VPN connection, but I may be missing the point.)

migrated from security.stackexchange.com Sep 9 '15 at 15:39

This question came from our site for information security professionals.

  • 2
    You really need to be asking these questions of the third-party you're working with. It's their setup, ask them what they mean. – gowenfawr Sep 8 '15 at 18:29
  • @gowenfawr - We are, but they are slow to answer and, when they do, they make out this is just obvious, common-sense stuff, that we should all be doing anyway. I just want to make sure I'm not missing something stupid, before I escalate – jimbobmcgee Sep 8 '15 at 18:32
  • Sounds to me like it's just FTP over SSL. When they say PEP I think they just mean an endpoint of the FTP connection. For any further interpretation than that, I agree with gowenfawr - you have to speak to your third-party contact. – paj28 Sep 9 '15 at 11:08

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.