On a project I had to use unsecured FTP to connect to the hosting provider - not SFTP, not FTPS. The hosting provider proudly claims it's ISO 27001 certified. Somehow this all seemed quite wrong to me.
Is it possible that a company gets ISO 27001 certification while still heavily making use of insecure protocols like FTP?
I'm not on this project anymore, I didn't get a proper answer when I asked in the past and I will definitely not get an answer if I ask the service provider about this now.
I'm mainly interested in knowing of how this works out in relation to ISO 27001 - and consequently to how much value I can place in this certification.
Is whoever gives out these certifications indifferent to an organization using FTP? Or is it more likely that the service provider kept this information away from the certifier?
Personally I don't trust any internet service provider that still uses FTP for anything. Let alone providing it as the primary option to their clients.
(I know the difference between FTP, SFTP and FTPS - well the difference between the latter 2 a bit less but that's beyond this question.)
Related but not duplicate:
UPDATE: Unsecured data WAS transmitted over an insecure channel. With a man in the middle attack skilled attackers would have easily been able to gain access to the internal network of the institution (I won't provide details here, but wow... I could've probably done it myself - and I'm not a pentest pro by any means). The service provider must have been aware of this.