If unencrypted FTP over the public internet is the only file transfer option for a particular situation, what security concerns are applicable assuming:
- The data being transferred is strongly encrypted by whatever / whoever is creating the files
- IP-restriction is in place at the firewall level so only one designated IP can connect via FTP
- There is protection in place on the FTP server against file deletion (though not overwriting)
- The credentials aren't valid for any other services (e.g. SSH access)
If someone sniffs the username and password, could they even do anything with it? I don't really understand what's possible with IP spoofing, but I'm thinking the only case where they could issue FTP commands with the credentials is if they had a privileged position somewhere along the network route and were able to spoof the IP that normally connects in via FTP - like a man in the middle type of attack though I'm guessing they could initiate it at will.
Of course if VPN / SSH port forward / etc. were options, those could be preferable, but I'm wondering about this particular situation.