| Create a specific AD
account on which EFT’s service is to run with the minimum
necessary permissions. |
| Create an Event Rule to back
up the entire Server configuration to a separate drive at
least daily. |
| Do not use any default administrator names
(e.g., "admin"). |
| Do not use the default
administration port (1100). |
| Only turn on remote
administration if necessary. If remote administration is needed,
then ban
all IPs except those trusted IPs necessary to access the server
for administration. |
| Turn
on SSL if using remote administration. |
| Create sub-administrator
accounts with the least amount of privileges necessary for
help desk or operational administrators. |
| Do not give sub-administrators access to
COM or the ARM (report) module unless absolutely necessary |
| If giving ARM (report) access to a sub-administrator,
use the ReportsConnectionString registry
override to define an alternate (least privileged) database connection
string for database queries. |
| Set administrator
passwords to expire every 90 days (or according to internal
best practices/policies). |
| Set a complex
security scheme for administrator passwords. |
| Lockout administrators for an extended period
after multiple failed
login attempts. |
| Run a PCI
DSS report to detect any lax security configuration settings
(either manually or on a schedule
with an Event Rule). |
| Periodically check the Globalscape
support site for the latest version and upgrade accordingly.
One more high priority bug fixes or fixes for security vulnerabilities
are often included. |
| Expire
accounts that are non-active for a specified period. |
| Set
user passwords to expire every 60 or 90 days. |
| Define complex password security scheme
for users. |
| Prohibit
password reuse/history. |
| When using HTTP/S and/or SFTP protocols,
require that the user reset their password upon initial use (requires
KIA support by the SFTP client. FTP/S protocol does not support
password reset upon initial login). |
| Briefly lockout users after repeated failed
logins. |
| Automatically
ban IP addresses with repeated failed username attempts. |
| E-mail
user login credentials separately or only send username and
communicate password via phone or other means (i.e., out-of-band
delivery). |
| Segregate
user’s folders. (Do not share folders/resources across users
when possible.) |
| Restrict users to their home folders and
set
the home folder as ROOT for that user. |
| Use Settings Templates to inherit
user permissions rather than modifying them for each user. |
| Use Groups
to simplify control over user access to resources. |
| Limit resource permissions
to the minimum necessary. |
| Specify a maximum
disk space (quota) for each user (or Settings Template). |
| Enable verbose
logging (Log Type). |
| Rotate
logs daily and encrypt+sign
using an Event Rule. |
| Always use extended auditing (ARM). |
| Examine audit logs at least weekly for anomalous
behavior |
| Encrypt data at rest using EFS encryption,
OpenPGP, or 3rd-party encryption. |
| Keep data separate (DAS/SAN/NAS). |
| Define data
recovery procedures in case of data corruption/loss/theft. |
| Scan uploaded files for viruses (3rd-party
tool required). |
| Never store data in the DMZ,
even temporarily. (Use DMZ
Gateway instead.) |
| Create a legacy data clean-up
rule according to your company policy. |
| Enable data
wiping for sanitizing deleted data. |
| Add a banned file type rule and disallow
all extensions except those required by the business. |
| Be extremely selective when choosing which
IPv4 or IPv6 addresses to bind to for a specific Site (listener).
Only bind to IPv6 addresses if your organization is aware of and
mitigating against IPv6-specific attacks at the edge of your network. |
| If possible, allow only secure protocols
(SSL, SSH,
HTTPS,
AS2). |
| Disable all unused services or features
that may adversely affect security, including Web
Services, any unused protocol listeners, and using
username and password credentials for use in Event Rule context
variables, if not needed by any Event Rule. |
| Always choose
the strongest ciphers, hashes, and key lengths; however to
mitigate the BEAST exploit, move RC4 (a lesser strength but non-CBC
cipher) to the top of the SSL cipher priority list, followed by
AES 256, then AES128, etc. |
| Allow only TLS 1.0 if possible, SSL 3 only
if necessary, for Server-wide
SSL Security settings. Do not enable Clear Command Channel
(CCC) nor unprotected data channel (PROT C). |
| Disallow site-to-site
(FXP) support for FTP/S protocol listeners, and block
client anti-timeout attempts. |
| Have your server’s SSL
certificate signed by Certificate Authority (CA). |
| If possible, require that the connecting
clients provide a certificate proving their identify in addition
to their authentication credentials. |
| Mask the server's identity by using generic
banner messages. |
| Specify a maximum
limit for connections and transfers for each user/template. |
| Enable EFT’s
Denial of service settings, disconnecting and banning users
that issue an excessive numbers of invalid commands (weighted
over a given period) and permanently banning IP addresses that
exceed the server's Flood/hammer value. Non HTTP/S setups should
set the Flood/hammer
slider to Very High, vs. the default Medium setting. |
