Most sysadmins I've talked to assume their file transfer setup is fine because it hasn't caused problems yet. That's not the same as it being secure, and the difference tends to show up at the worst possible moment.
Here are five things worth checking if you haven't looked at your setup recently.
- You're still using FTP somewhere
It sounds obvious but you'd be surprised how often a legacy FTP connection is still running quietly in the background, usually because it's been there for years and nobody wanted to touch it. FTP sends credentials and data in plain text with zero encryption. If it's still in your environment, it's a liability. SFTP or FTPS should be the minimum standard for any file transfer involving sensitive data in transit.
- Your audit logs aren't detailed enough to satisfy an auditor
A lot of setups log that a file was transferred but not who accessed it, from where, or what they did with it. If you work in a regulated environment — healthcare, finance, legal — that's a compliance problem waiting to happen. HIPAA compliant file transfer requires granular audit trails that show exactly who touched what data and when. If you can't answer that question in under five minutes, your logging needs work.
- You're relying on a single point of failure
If your SFTP server goes down, what happens to your file transfer operations? A lot of organizations don't have a real answer to that question because high availability feels like an enterprise problem until it isn't. Active-active high availability across multiple nodes isn't just for large enterprises — any organization transferring business critical data should have a plan for what happens when the primary server has a problem.
- Your staff can access more than they need to
Overly permissive access controls are one of the most common issues in secure file transfer environments and one of the easiest to fix. If users can access folders that have nothing to do with their role, that's unnecessary exposure. Granular access controls, virtual directories, and role based permissions exist for a reason — using them properly significantly reduces the blast radius if credentials get compromised.
- You haven't thought about what happens after a ransomware hit
Ransomware increasingly targets data in transit and data at rest simultaneously. If your file transfer server gets hit and you don't have secure offsite backups that are tested and actually restorable, you're in a difficult position. The backup existing isn't enough — when did you last verify it actually works?
None of these are exotic problems. They're the kind of things that get deprioritized because they haven't caused an incident yet. The organizations that tend to avoid serious data breaches aren't necessarily running more sophisticated setups — they just got the fundamentals right and kept them right.
Worth doing a quick audit of your own setup against this list. You might find more gaps than you expected.
