FTP

## What is FTP? **File Transfer Protocol (FTP)** is a **standard network protocol** designed to **upload, download, and manage files** between a client and a server. It operates over **TCP** and has historically been used for website hosting, file distribution, and administrative transfers. FTP is one of the oldest protocols still encountered in IT environments. ## Why FTP matters FTP matters because it: - Established early standards for file transfer - Is still present in legacy systems and workflows - Is widely supported by tools and platforms - Helps explain modern secure alternatives Understanding FTP is essential for assessing **legacy risk**. ## How FTP works (simplified) FTP uses two separate connections: 1. **Control channel** -- for commands and responses 2. **Data channel** -- for file transfers Depending on the mode, the server or client initiates the data connection. ## Active vs passive mode FTP supports two connection modes: | Mode | Description | | --- | --- | | **Active FTP** | Server initiates data connection to client | | **Passive FTP** | Client initiates both control and data connections | Passive mode is more firewall-friendly and commonly used today. ## Authentication in FTP FTP typically supports: - Username and password authentication - Anonymous access (public downloads) By default, credentials are sent **in clear text**, which poses security risks. ## Security issues with FTP FTP is considered **insecure by default** because: - Credentials are transmitted unencrypted - Data is sent in clear text - Sessions can be intercepted - Susceptible to credential theft and sniffing - Often targeted in brute-force attacks FTP should not be exposed on untrusted networks. ## Secure alternatives to FTP Modern secure alternatives include: - **FTPS** -- FTP over TLS encryption - **SFTP** -- File transfer over SSH - **HTTPS** -- Web-based secure transfers - Cloud storage and managed file services Most organizations are migrating away from plain FTP. ## FTP in enterprise environments FTP is still encountered in: - Legacy applications and integrations - Automated batch file transfers - Industrial or embedded systems - Older hosting platforms Such usage typically requires isolation and compensating controls. ## FTP vs SFTP | Aspect | FTP | SFTP | | --- | --- | --- | | Encryption | No | Yes | | Authentication | Basic | SSH-based | | Firewall handling | Complex | Simple | | Security | Weak | Strong | SFTP is generally preferred for secure environments. ## Common misconceptions - "FTP is encrypted by default" - "FTP and SFTP are the same" - "FTP is obsolete everywhere" - "FTP is safe on internal networks without controls"