Agencies lax about file transfer security

A survey finds the basics of file protection are often ignored

The government spends $7.9 billion annually on sophisticated cybersecurity measures, but agencies too often ignore the basics of protecting files, according to a new survey on federal encryption and other security measures.

In April, MeriTalk, a government information technology provider, teamed with Axway, a business interaction networks company in Phoenix, to survey 200 federal IT and information security professionals on file transfer practices and potential security improvements.

The survey found that employees at agencies whose managers understand the effects of cyber threats are more than twice as likely (53 percent vs. 12 percent) to follow correct policies. However, only 58 percent of those surveyed are aware of agency file transfer policies.

The survey report, “Why Encrypt? Federal File Transfer Report,” found that data security vulnerabilities at federal agencies are mainly due to employees’ use of unsecure methods to exchange information, such as File Transfer Protocol (FTP).

The unsecure methods exist despite the Secure Federal File Sharing Act, which the House passed March 24 to prevent government employees from using peer-to-peer file-sharing software, including FTP, the report states.

Specifically, the report shows that federal employees use unsafe methods to transfer files in the following ways:

  • 66 percent use physical media (e.g., tapes, CDs, DVDs, USB drives, etc.).
  • 60 percent use FTP.
  • 52 percent send work files through personal e-mail accounts (e.g., Gmail, Yahoo, etc.).

The report calls for agencies to gain the support of top managers and educate employees about the need to secure federal data.

About the Author

David Hubler is the former print managing editor for GCN and senior editor for Washington Technology. He is freelance writer living in Annandale, Va.

Who's Fed 100-worthy?

Nominations are now open for the 2015 Federal 100 awards. Get the details and submit your picks!

Featured

Reader comments

Fri, May 14, 2010 Lateral

While 4(3)(B)(i) would seem to exempt FTP and HTTP only using the Internet Domain Names; but would they exempt INTRANETS, or using just IP addresses across the Internet? This is an example of how technology issues don't get translated into law very effectively--see FISMA for the best example.

Wed, May 12, 2010 WOR

So ftp is now a peer-to-peer application? The Secure Federal File Sharing Act talks specifically of open-network peer-to-peer file sharing software (see summary here: http://www.govtrack.us/congress/bill.xpd?bill=h111-4098&tab=summary)

Wed, May 12, 2010

So ftp is now a peer-to-peer application?

Wed, May 12, 2010

Way back when, the Federal Government disapproved of Pretty Good Privacy. It was free and unbreakable. Free versus $7.9 billion, yearly. Do the cost savings!!!

Wed, May 12, 2010 Michael D. Long Knoxville, TN

While there is no specific mention of File Transfer Protocol (FTP), a reading of the language reveals such appliations would not be affected should this bill become public law. There is an exclusion in Section 4(3)(B)(i), which states "to operate as a server that is accessible over the Internet using the Internet Domain Name system." This clearly exempts FTP, as well as HTTP which would otherwise be included had this exemption not be incorporated.

Show All Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above