FTP & File Transfer Assessment

This guide treats FTP, FTPS, SFTP, and managed file-transfer services as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   Identify business owners and required transfer partners.

2. 02

   Separate FTP, explicit FTPS, implicit FTPS, SFTP, and web-based transfer paths.

3. 03

   Record authentication, encryption, storage, retention, and malware-scanning controls.

4. 04

   Map inbound, outbound, and administrative directories.

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Verify plaintext FTP is disabled or isolated according to policy.

2. 02

   Use a benign test file to validate directory permissions and ownership.

3. 03

   Confirm anonymous access is disabled unless intentionally public.

4. 04

   Check that partner accounts cannot cross directory or tenant boundaries.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Log authentication, uploads, downloads, administrative changes, and malware verdicts.
• Alert on unusual volume, file types, geography, and dormant-account use.
• Track failed transfers without retaining unnecessary file content.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Migrate legacy FTP to managed encrypted transfer.
• Use partner-specific identities and least-privilege directories.
• Scan inbound content and enforce retention.
• Rotate dormant accounts and review public shares.