Secure file copying with WinSCP

computers. Windows has built-in support for FTP, which is available at the command prompt for command-line execution and Internet Explorer provides a basic graphical front-end. Both Windows-native methods lack security, since file transfers via FTP authenticate and take place in the clear.

WinSCP is easy to use, providing two optional interfaces: one that looks similar to the old Norton Commander file manager and the other similar to Windows Explorer. It supports securely dragging and dropping files for transfer across a network and can be integrated directly into the Windows shell. It supports directory synchronization, allowing directory comparisons and highlighting files that are different, and then transferring new and updated files. It also supports automation scripting and command line option flags.

From a security standpoint, WinSCP delivers the goods. It supports file transfers using encrypted tunnels, DES, 3DES, Blowfish and AES. It can use SSH v1 and v2, or can be set to only accept connections from hosts/clients employing the stronger v2.

For more information: In this expert Q&A, Mike Chapple discusses why FTP will never be a secure way to transfer files. Information security threats expert Ed Skoudis explains the malware-related risks of copying files. Michael Cobb reviews the strengths and weaknesses of Internet protocols FTPS, SCP and SFTP.

WinSCP supports multiple secure authentication mechanisms, including"keyboard-interactive" two-factor authentication. With keyboard-interactive authentication, the server can prompt for special credentials such as an S/Key one-time password or RSA SecurID generated value. These "disposable" credentials are preferable when using a public computer. WinSCP also supports cryptographic certificates using public and private keys. To avoid having your private key stolen and used to authenticate sessions on your behalf, WinSCP supports requiring that a passphrase be entered when authenticating your key. WinSCP also supports storing standard single-factor passwords with saved sessions, a convenience that is not recommended, but can be restricted and disallowed by a system administrator.

In addition to strong security, WinSCP provides another thing that some free tools may not: an excellent Web site with well-written documentation. There are lots of screen shots and pages of helpful explanations and how-to's.

WinSCP has won many awards, is well supported and has a very active community, making it an easy tool to recommend.

About the author:
Scott Sidel is an ISSO with Lockheed Martin.