If you're planning to use FTP in your environment, I'd advise carefully considering the business case for that implementation to ensure that there is a true need for the protocol.
It's important to remember that FTP is an inherently insecure protocol, as it does not use any type of encryption, even for authentication. The usernames, passwords and data transmitted via FTP are open to eavesdropping as they cross the Internet. Unless you're planning a public access site that allows downloads without having to provide personal credentials, I'd strongly recommend that you consider the use of a secure alternative, such as Secure FTP (SFTP).
Again, I can't stress strongly enough that FTP alone is not secure. It should only be used in two cases: running a public access anonymous download site and running an internal file service that is protected against eavesdropping by other means, such as network segmentation.
This was first published in December 2008