I work for a municipal government, using mostly Windows servers. In recent days several similar governments in our geographic area have been attacked, some successfully, by ransomware. So our security folks are alarmed, and have decreed (among other things) no more using SMB file-sharing to upload files from the "internal" network to the DMZ. I have a PowerShell script that does just that, to migrate databases; plus we have many other cases to use file shares such as uploading web sites.
They are saying we need to convert to using SSH or SFTP to transfer files. OK, this would be possible, but it would need setup work on every DMZ server, and changing all our current processes, and for what? (We don't have enough people to do that plus everything else, although we've tried to get more warm bodies budgeted.) Anyway I don't see how that's more secure. If DMZ server D is listening on a share, and the firewall prevents access from anywhere but authorized internal workstations or servers A, B, and C, then how can that be any more a security risk (specifically, the risk of malware on server D going back the other way and compromising A, B, or C) than server D listening on an SFTP port or an SSH port, with the same firewall restrictions?
If the issue is something like "the file share is open all the time, but SSH isn't," then that would be somewhat understandable, and we might deal with that by mapping and unmapping to the shares when needed. But I don't think this is their reasoning; I think it's something else. Actually I get the impression it's kind of a vague "feeling" on their part, that file shares are inherently and materially less secure, in the "backward" direction, even if firewall-protected as described above. If this is actually so, then why? I just don't see it. Actually I don't see why any of those protocols would pose a risk in the "backward" direction.
To clarify, there are two things to consider: (1) a regular user having a drive mapped all the time, and (2) an automated script or other situation where the share is accessed briefly, and then any mapping is removed. I do have to consider both situations but primarily, right now, I'm referring to (2). Case (1) would not ordinarily be used to access the DMZ.