Transferring data securely

Techniques for transferring data securely

Transferring files from computer to computer (and person to person) is a common occurrence. Perhaps you need to send a class roster spreadsheet to an office assistant or a document containing a grant proposal to a colleague at another university. In each of these cases, it's important to know what options are available to get your file from point A to point B using a method appropriate for the data being transferred.

These techniques preferably encrypt the data over the network (in transit) and in storage (at rest) and require strong authentication to ensure both the sender and recipient are who they claim to be. This document will describe some common techniques for transferring files safely and some to avoid.

Secure Share

The new secure file-sharing service features a quick and easy way to create an encrypted file to share pieces of secure information. Secure Share features enhanced security and an improved customer experience.

Starting September 30, the previous file-sharing service, Slashtmp, will be read-only, and no new files can be added after that date.

Learn more about Secure Share

File Storage

IU maintains easy-to-use services to share files with colleagues at IU or elsewhere. These services may be used for certain kinds of institutional data, but are not yet approved for data classified as Critical.

The SSH (Secure Shell) suite of programs and protocols provide a highly configurable way to transfer data safely and even encrypt data streams from other programs that are otherwise not secure. Compared with Slashtmp and Box, these tools provide a stronger understanding of computer operating systems and networks. These techniques ensure encryption in transit but not at rest. They require password or asymmetric key authentication (recommended).

HTTP

HyperText Transfer Protocol (HTTP) is a protocol commonly used to transfer hypertext documents between a Web server and a Web browser. HTTP also provides the ability to transfer files using GET and PUT commands. By default, HTTP performs no user authentication, nor does it do any sort of data encryption. Only files classified as Public or University Internal should be transferred using HTTP. Under no circumstances should passwords or passphrases be validated through an HTTP Webpage.

Encryption-in-transit can be added to HTTP using Transport Layer Security (TLS), rendering it safe for some applications. This combination of protocols is often called HTTPS and is supported by most web servers (or using an external program such as stunnel). HTTPS typically only provides authentication of the server end, so the server must often explicitly authenticate the client or use an authentication service such as CAS.

FTP

File Transfer Protocol (FTP), though efficient for transferring files, lacks any significant security features. The username, password, and data are sent across the network. In addition, there are no built-in safeguards to ensure the computer on the other end of the FTP connection (machine B in this example) is what it claims to be. These safeguards can be added with tools such as SSH or stunnel, but without them, FTP should only be used for data classified as Public or University Internal.

Email

Email uses the Simple Mail Transfer Protocol (SMTP) for transmitting email messages and attachments across the Internet. While protocols such as FTP normally only transfer data between two computers, SMTP often sends data through several machines before it ends up in the recipient's email inbox. SMTP often performs no user authentication or data encryption. The Cisco Secure Email Encryption Service (CSEES) provides some safeguards against the lack of safeguards typically found in SMTP. Except where CSEES is used, only data classified as Public or University Internal should be transferred using SMTP.