SFTPPlus and its relevance with the OIAC Privacy Act and ASD ISM

Standard Operating Procedures (SOPs)

While the manual itself encompasses a wide range of topics from access controls to the use of ICT equipment, we have mapped components (SOPs) that is of direct or indirect relevance to file transfers involving SFTPPlus.

The following are Standard Operating Procedures (SOPs) as listed from page 36 of the ISM.

Access control

Procedure to be included: Authorising access rights to applications and data.

The SFTPPlus features that will help organizations meet this SOP include; ability to authorize access based on an existing authentication method (such as LDAP or operating system), ability to authorize or via an SFTPPlus application account.

Another example of rolling out proper access authorization is via permissions. User permissions can be set in the application based on extension (such as only making .exe files read-only) and directory (such as only allowing full control for certain folders).

Audit logs

Procedures to be included: Reviewing system audit trails and manual logs, particularly for privileged users.

For each server event that is emitted, this is logged within an audit trail that is available for SFTPPlus administrators. The example log below is of a user authenticating:

| 30014 2018-04-02 10:50:42 Process Unknown 127.0.0.1:50668 New SSH
  connection made.
| 20137 2018-04-02 10:50:42 single-server-uuid 127.0.0.1:50668 Account
  "erica" of type "os" authenticated as "erica" by os authentication
  "Operating System Accounts" using ssh-key.

Note that details such as the date, time, type of connection, type of authentication, account name and more are included in this audit log.

Data Transfers

Procedures to be included: Managing the review of media containing information that is to be transferred off-site. Managing the review of incoming media for viruses or unapproved software.

For the thorough review of media containing sensitive information, it is expected that SFTPPlus be integrated with a DLP (data leak prevention) software and other related policies to help prevent data leaks.

For the review of incoming media, SFTPPlus can also be integrated with antivirus checks as part of a file transfer process.

Our own customers are already integrating with a number of software that monitors and protects the boundary as part of their file transfer infrastructure.

System integrity audit

Procedures to be included: Reviewing user accounts, system parameters and access controls to ensure that the system is secure. Checking the integrity of system software. Testing access controls.

The text configuration server.ini file is available to review all configurations - from the authentication methods, configuration parameters and configuration options right through to the services being used.

The SFTPPlus Local Manager also includes the ability to review any changes made, before applying it to the system.

System maintenance

Procedures to be included: Managing the ongoing security and functionality of system software, including; maintaining awareness of current software vulnerabilities, testing and applying software patches /updates / signatures, and applying appropriate hardening techniques

SFTPPlus upgrades are designed to minimize disruption.