Why you should use SCP to securely transfer files

Here’s a scenario: You’re tasked with transferring a number of important files to multiple systems. As usual, you are pressed for time, so you skip ahead to simply copying the files via a script you’ve had since the dawn of your IT career to make short work of the transfer process. But if the data is so important, why are you entrusting the security (and by extension the integrity) of the files to an unsecured copy program that may or may not do the job and will not protect sensitive data from interception?

SEE: Identity theft protection policy (TechRepublic Premium)

It sounds a little obvious, but I have met a number of IT pros throughout my career that still default to the common, yet unsecure, way of doing basic tasks like this, knowing full well what’s at stake given the sensitivity of the data they’re working with. And I get it: In the heat of the moment you just want to get something like this done so you can get back to more meaningful work. Sadly, the threat actors are looking for an opportunity like this to modify and exfiltrate data with little difficulty.

Thankfully, the secure copy protocol (SCP) not only resolves this problem elegantly, but it provides some added flexibility to allow copying of data between systems directly or through a third box while encrypting the data transfer. It’s little more than a tried-and-true copy utility tunneled through Secure Shell (SSH).  And since it’s baked into most major OSes, there’s cross-platform support, which means existing scripts can be updated and made universal to work across all supported systems.

If you wish to add an extra layer of security to your SSH connections, creating an SSH key pair is just the thing to secure connections between client devices. By providing the SSH key to each device you will be communicating with, it will authenticate the device you’re connecting from using the powerful RSA security protocol. TechRepublic writer Jack Wallen has provided an excellent write up of exactly how to go about implementing SSH key authentication with step-by-step instructions to guide you through the process.

SEE: Social engineering: A cheat sheet for business professionals (free PDF) (TechRepublic)

It’s important to note that the use of SSH key authentication does not replace SCP for file transfers, but it augments the existing security to verify the devices that are communicating. If a device is not recognized, then it could be either a new device that doesn’t have the proper keys installed or could be an indicator of a device impersonating another. 

SSH key authentication will not overtake the authentication scheme for SCP. Just because a key is installed it will not automatically log you into your target clients. You will still need a password to verify the authenticity of the key, and thus, the device you are communicating from, alongside your identity. No password = no access, even if the key is installed properly. If you do have a lot of devices to manage, SCP with SSH key authentication will make your transfers that much more secure and provide less overhead when logging into devices remotely.

Also see