2

I need to send credit-card numbers and other information through SFTP. What considerations should I have? Recommendations? Is valid encrypt this numbers? What does PCI say about this?

Improve this question
5
  • 1
    Hello and welcome to Information Security! I am not sure I understand all of the question. Could you clarify this part: "Is valid encrypt this numbers?"
    – Anders
    Commented Apr 11, 2017 at 14:59
  • Are you talking a batch of credit numbers in some sort of file? Is this a regular import / export process or a one of transfer? Are they full numbers or masked? What is the other info? Are you talking card holder, expiry, cv2?
    – iainpb
    Commented Apr 11, 2017 at 15:41
  • Is a diary transfer of files. In this file have a some data of persons and a full numbers of credit-cards, without cv2, masked or any type of encryption.
    – gonisimchuk
    Commented Apr 11, 2017 at 17:24
  • PCI say "4.1 Use strong cryptography and security protocols (for example, SSL/TLS, IPSEC, SSH, etc.) to safeguard sensitive cardholder data during transmission over open, public networks. ". In this case, thorugh SFTS is used SSH. This right? Is necessary other type of control?
    – gonisimchuk
    Commented Apr 11, 2017 at 17:30
  • yes, ssh and thus "sftp" would seem to meet your criteria.
    – dandavis
    Commented Apr 11, 2017 at 19:28

2 Answers 2

Reset to default
1

Regardless the file transfer protocol, I would recommend encrypting files before sending them out. You may use for example pgp encryption, it can be automated.

Improve this answer
0

Since you are using SFTP, there must be some certificate associate with it(which gives us all the information about the validity and level of security/encryption). Mainly there are two things you should check for such operation.

1) The credibility of the certification authority(Who has issued the certificate). Sometimes self signed certificates are also used.Accept such certificates only if you trust the issuer.

2) The encryption technique and key-length used for encryption. Make sure the encryption technique is not obsolete(RSA is the most common and widely used these days) and the key is long enough to make it hard for anyone to crack it(2048 will be good).

Improve this answer
2
  • 3
    SFTP does not use certificates (it does not rely on SSL/TLS), however the second point is a valid one.
    – WhiteWinterWolf
    Commented Jul 18, 2017 at 8:20
  • 3
    SFTP uses host keys instead of certificates, and host keys don't use a central trusted authority. You need to make sure the sending machine already knows the host key of the receiving machine (and you've verified that it's correct), or you could fall for a man-in-the-middle attack.
    – dogoncouch
    Commented Jul 18, 2017 at 15:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .