I've investigated a number of MoveIT incidents and they're all looking about the same now. At this point, we should consider hosting a file transfer site a bad

I've investigated a number of MoveIT incidents and they're all looking about the same now. At this point, we should consider hosting a file transfer site a bad practice. These sites are usually used to transmit files between two organizations. Tactically, what could have been done to minimize or prevent this particular incident, while continuing to use MoveIT software: - Encrypt the files before dropping them onto the file transfer site. Communicate the key out-of-band. This one simple step would have avoided catastrophe. Unfortunately, many MoveIT site operators would not allow their customers to encrypt files sent to them. - Limit MoveIT site access, by IP address. This is a fairly common practice for file transfer sites. - Use a frontend, such as a load balancer or reverse proxy, that enforces authentication in front of MoveIT. - Disable the web site and only allow use of the SFTP (SSH) site.