Secure file copying with WinSCP

WinSCP is easy to use, providing two optional interfaces: one that looks similar to the old Norton Commander file manager and the other similar to Windows Explorer. It supports securely dragging and dropping files for transfer across a network and can be integrated directly into the Windows shell. It supports directory synchronization, allowing directory comparisons and highlighting files that are different, and then transferring new and updated files. It also supports automation scripting and command line option flags.

From a security standpoint, WinSCP delivers the goods. It supports file transfers using encrypted tunnels, DES, 3DES, Blowfish and AES. It can use SSH v1 and v2, or can be set to only accept connections from hosts/clients employing the stronger v2.

For more information: In this expert Q&A, Mike Chapple discusses why FTP will never be a secure way to transfer files. Information security threats expert Ed Skoudis explains the malware-related risks of copying files. Michael Cobb reviews the strengths and weaknesses of Internet protocols FTPS, SCP and SFTP.

WinSCP supports multiple secure authentication mechanisms, including"keyboard-interactive" two-factor authentication. With keyboard-interactive authentication, the server can prompt for special credentials such as an S/Key one-time password or RSA SecurID generated value. These "disposable" credentials are preferable when using a public computer. WinSCP also supports cryptographic certificates using public and private keys. To avoid having your private key stolen and used to authenticate sessions on your behalf, WinSCP supports requiring that a passphrase be entered when authenticating your key. WinSCP also supports storing standard single-factor passwords with saved sessions, a convenience that is not recommended, but can be restricted and disallowed by a system administrator.

In addition to strong security, WinSCP provides another thing that some free tools may not: an excellent Web site with well-written documentation. There are lots of screen shots and pages of helpful explanations and how-to's.

WinSCP has won many awards, is well supported and has a very active community, making it an easy tool to recommend.

About the author:
Scott Sidel is an ISSO with Lockheed Martin.

Rate this Tip To rate tips, you must be a member of SearchSecurity.com. Register now to start rating these tips. Log in if you are already a member. Digg This!     StumbleUpon     Del.icio.us    RELATED CONTENT Scott Sidel's Downloads Ophcrack: Password cracking made easy Nipper audits routers, reveals insecure settings Enigmail: Wrapping email in a digital security blanket FreeRADIUS: Acing a secure connection Spiceworks: Free network monitoring and management with a little zest VirusTotal: On-demand antivirus service scans malicious files Shining a spotlight on rootkits Closing the case on network firewall security with IPCop Eliminating the threat of spam email attacks ClamAV clamps down on e-mail security Open Source Security Tools Using Nessus Attack Scripting Language (NASL) to find application vulnerabilities What are best practices for creating an IDS and maintaining a signature database? How to install and configure Nessus How to run a Nessus system scan Nessus: Vulnerability scanning in the enterprise Nessus 3 Tutorial Screencasts: On-screen demonstrations of today's IT tools Screencast: An introduction to the Open Source Security Testing Methodology Manual (OSSTMM) Ophcrack: Password cracking made easy Will Cisco's plan to open access to the IOS improve network security? SSL Product review: Array Networks SPX2000 The Shortcut Guide to Extended Validation SSL Certificates How to test the security of personal details submitted to a website Should enterprises implement a mandatory iPhone VPN? Should iPhone email be sent without SSL encryption? How to secure an FTP connection Can Trojans and other malware exploit split-tunnel VPNs to infiltrate a network? What are the risks of connecting a Web service to an external system via SSL? What is the most secure way for application developers to manage cookies? Should an IT staff be concerned with a network's physical security? RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary Back Orifice  (SearchSecurity.com) Blowfish  (SearchSecurity.com) Kermit  (SearchSecurity.com) Open Source Hardening Project  (SearchSecurity.com) Snort  (SearchSecurity.com) SnortSnarf  (SearchSecurity.com) RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.