TEN03-08acc.pdf

ETA Advisory File Text

EMPLOYMENT AND TRAINING ADMINISTRATION U.S. DEPARTMENT OF LABOR WASHINGTON D.C. 20210 NO. 3-08 TRAINING AND EMPLOYMENT NOTICE DATE August 7 2008 TO STATE WORKFORCE AGENCIES FROM CHERYL ATKINSON s Administrator Office of Workforce Security SUBJECT Removal of File Transfer Protocol FTP Access from the States Sun Systems 1. Purpose . To notify State Workforce Agencies SWAs that FTP will be removed from the states Sun systems on October 1 2008 and recommend secure file transfer protocol SFTP tools. 2. References . National Institute of Standards and Technology NIST 800-52 NIST 800-53 Revision 2 Department of Labor Computer Security Handbook Volume 16 Section II System and Communications Protection Procedures Version 2.1 and the Federal Information System Controls Audit Manual FISCAM . 3. Background . The Department of Labor provides each state with data processing equipment and software for use in making required reports to the Department electronically in standard formats. Data contained in these reports are downloaded from states mainframe computer systems to the Sun computer servers provided by the Department for reporting purposes. Software installed by the Department on the Sun servers currently includes FTP. 4. Issue Action . The FTP utility which uses clear text transmission is considered a security risk because personally identifiable information and other sensitive information are transmitted as plain text. Current security standards require such information be transmitted over an encrypted network. Due to this security risk and based on a 2007 FISCAM audit of the state Sun system the Department will remove the File Transfer Protocol FTP from the states Sun systems effective October 1 2008. The FISCAM audit found that encrypted text transmission must be incorporated. In order to address this finding state users must begin transferring their files by Secure File Transfer Protocol SFTP . 5. Options to Transfer Files . Since the SFTP tools which can be used to transfer files from the states mainframes to the states Sun systems are expensive state users have the option to transfer files from their mainframes to a desktop computer running either Linux or Microsoft Windows using one of the free SFTP programs listed below. Free Software Information http www.winscp.net Documentation http winscp.net eng docs start WinSCP Download Access http winscp.net eng download.php Information http www.chiark.greenend.org.uk sgtatham putty Documentation http the.earth.li sgtatham putty 0.60 puttydoc.txt PuTTY PSFTP Download Access http the.earth.li sgtatham putty latest x86 psftp.exe Currently state users have the capability to load all web-based Unemployment Insurance Report UIR and Data Validation DV extract files directly from a PC or the Sun system. This feature will be incorporated into the other applications e.g. BAM and TPS in the near future. 6. Action . State Administrators are requested to provide the information contained in this advisory to the appropriate staff. 7. Inquiries . If you have any questions or problems are encountered with the downloading or the use of the above cited free software please contact the Office of Workforce Security OWS Technical Staff Hotline at 1 - 800 473-0188.