How to secure file transfers and protect data in motion

The Netwrix 2026 Data and Identity Security Report found that 69% of organizations can't instantly and fully prevent sensitive data from leaving endpoints for external AI tools, personal email, or USB. That blind spot makes cross-channel enforcement a practical case for consolidation, since one content-aware policy can cover exit paths that a secure transfer protocol never reaches.

Even after IT teams deploy an SSH File Transfer Protocol (SFTP) server or an approved sharing tool, a sensitive spreadsheet can still end up in a personal cloud folder, a personal email attachment, or a chatbot prompt. Harvard Business Review research found that employees often take the unsanctioned route simply because the approved one was slower or they didn't know it existed.

That creates two separate problems. Protocol security asks whether the sanctioned channel protects data in transit. Transfer enforcement asks whether sensitive data uses that channel at all, and most guidance stops after the first question. Together, those controls strengthen cyber resilience and data security posture while producing reliable evidence for audits and investigations.

What is secure file transfer?

Secure file transfer is moving data between systems or people in a way that keeps it unreadable in transit, confirms who sends and receives it, and leaves a record of the transfer. NIST SP 800-53 Rev. 5 treats encryption, authentication, and audit logging as separate requirements, so a protocol alone can't cover all of them. Protecting data in motion requires all three, and each can fail in its own way.

Encryption in transit

Data-in-transit encryption keeps information unreadable to anyone who intercepts it. The National Cyber Security Center (NCSC) explains in its TLS guidance that well-configured Transport Layer Security (TLS) stops third parties from eavesdropping on or tampering with messages. NCSC recommends TLS 1.3 or 1.2, with versions 1.1 and 1.0 disabled. Configuration matters as much as the protocol name, since a server that still accepts an old version can fall back to it.

Authentication of both ends

A secure transfer verifies both parties before data moves. NIST defines mutual authentication as the process in which both entities in a transaction verify each other, but common protocols make the second half optional. In TLS 1.3, the server always authenticates, while client authentication is optional (RFC 8446). SFTP relies on host keys for the server side, with the client authenticating separately.

A verifiable record that it happened

Logs showing what moved, when, and between whom are what investigators need later. The 2023 MOVEit Transfer breach illustrates why that record matters even on an encrypted channel. According to CISA's advisory on the campaign, attackers exploited a SQL injection flaw to bypass authentication entirely, create their own administrator accounts, and deploy a web shell that exfiltrated files.

TLS encryption protected the channel throughout the incident. The application-layer flaw defeated authentication instead, which is why encryption, authentication, and logging each need independent validation rather than one control standing in for the other two.

What are the protocols for secure file transfer?

Plain File Transfer Protocol (FTP) and unencrypted Hypertext Transfer Protocol (HTTP) are the baselines the protocols below improve on. FTP sends passwords in clear text through the PASSExpand command (RFC 2577). The Cybersecurity and Infrastructure Security Agency (CISA) warns in its Binding Operational Directive 18-01 that attackers can easily monitor, modify, and impersonate plain HTTP connections.

SFTP (SSH File Transfer Protocol)

SFTP is a sensible default for server-to-server and partner transfers. It runs file transfer inside an SSH session, so it inherits encryption, server authentication, and integrity protection from the SSH transport (RFC 4253). A host-key signature authenticates the server, and the user authenticates with a public key, password, or host-based method.

Everything travels through one multiplexed tunnel on port 22, so SFTP needs fewer firewall openings than FTPS. To harden it, set StrictHostKeyChecking to yesExpand so clients refuse any host whose key has changed.

FTPS (FTP over TLS/SSL)

FTPS wraps FTP in TLS. Per RFC 4217, the session isn't protected until the client sends AUTH TLSExpand on the control connection (port 21) and the server trusts the client via X.509 certificates. Implicit mode on port 990 is deprecated.

The operational cost is the separate data channel, since passive mode needs an open port range and stateful firewall inspection can't read encrypted FTP commands. That firewall complexity is one reason teams commonly choose SFTP for new builds, though FTPS still earns its place where existing FTP endpoints and partner scripts need upgrading rather than rewriting.

HTTPS-based transfer

HTTPS, or HTTP over TLS, is the default for browser uploads, download portals, and app-to-app API transfers, all running on port 443. The server is authenticated, the whole exchange is encrypted, and the client checks the hostname against the certificate before trusting it (RFC 9110, RFC 2818).

By default, HTTPS authenticates only the server; the uploader's identity comes from a separate login or token you configure and log in to separately. For a portal or API upload, the sender controls that login, token, or time-limited link, so configure it as carefully as the TLS settings.

AS2 (Applicability Statement 2)

AS2 is built for business-to-business transactions where both sides need proof. It packages electronic data interchange (EDI) formats, such as X12 and Electronic Data Interchange for Administration, Commerce and Transport (EDIFACT), as Multipurpose Internet Mail Extensions (MIME) over HTTP (RFC 4130).

AS2 uses Secure/Multipurpose Internet Mail Extensions (S/MIME) for encryption and signatures and returns a signed Message Disposition Notification (MDN) as the receipt. The partner's public key verifies that signed MDN, and a matching hash provides non-repudiation of origin and receipt over HTTP. That machinery suits structured B2B exchanges; general file sharing inside an organization rarely needs it.

Where sensitive data leaks when the secure channel gets skipped

Every protocol above protects one channel, while people often move sensitive data through others. Most of that movement comes from ordinary employees taking a faster route rather than deliberate exfiltration, the pattern behind most insider threat incidents.

The 2026 Verizon Data Breach Investigations Report ranks shadow AI as the third most common non-malicious insider action in its DLP dataset, a fourfold increase over the prior year. That pattern lines up with the operational friction described earlier, since approved routes can be slower or simply unfamiliar.

A personal cloud storage account

A personal Dropbox or Google Drive account is invisible to a system built to monitor only the approved transfer method. Controlling that exit path requires something that can distinguish a sanctioned organizational account from a personal one, not just flag an unfamiliar domain.

A personal email address

An attachment sent to a personal inbox bypasses the sanctioned system entirely, so a policy covering only that system never sees it. Email can also fail quietly, since NCSC warns that a failed TLS negotiation can cause a message to fall back to plain-text delivery.

A USB drive or other removable media

Removable media slips past a program that watches only network channels because a USB copy generates no egress traffic. Endpoint auditing and device control have to cover removable storage directly.

An AI tool's input box

Pasting a file's contents into a chatbot is a file transfer too, and older transfer guidance often never accounts for it. The 2026 Verizon DBIR found that 67% of users access AI services with non-corporate accounts on corporate devices. That pattern makes it more practical to extend an existing content-aware policy than to stand up AI as a separate transfer program.

How to find the unsanctioned and legacy channels already in use

Effective enforcement starts with an inventory of the channels already carrying data, not the ones a policy assumes are in use. Continuous discovery directs limited effort toward what people use today.

Scan firewall rules and network traffic for legacy FTP

Start with the firewall. SANS Internet Storm Center suggests searching firewall logs with grep /21 | grep -i permitExpand to surface anything still allowed on FTP's control port. Domain Name System (DNS) logs, or Sysmon Event ID 22, can reveal queries to an old file server's hostname. For scheduled tasks that call FTP, Get-ScheduledTaskExpand and Export-ScheduledTaskExpand dump each task's definition, and Windows Security Event 4698 fires on every new scheduled task with its full XML.

Read egress logs at the proxy, firewall, or CASB

Pull a web proxy or firewall log and check for destination domains such as dropbox.com and personal webmail providers. Match what you find against MITRE's analytics for T1567.002, which flags unusual processes posting to dropbox.com, drive.google.com, and box.com.

Feed the same logs into a cloud access security broker (CASB) to build a shadow SaaS inventory, provided they include uploaded bytes, usernames, and target URLs. For removable media, enable Windows Security Event 6416 to catch new external devices, and turn on Audit Removable Storage so Event 4663 records reads and writes.

Build the check into tools already running, not a standalone project

Integrate these checks into the SIEM so new tools and accounts don't wait for an annual audit. A rule that fires on a first-seen destination domain or removable-media event flags the change on the day it happens. SigmaHQ publishes rules for DNS queries to MEGA and other file-sharing sites, and a first-time-seen removable-device rule can map directly to technique T1052.001.

Enforcing the policy at the point of transfer

Discovery shows which channels carry data today. With content-aware DLP for file transfer, you decide what happens when someone tries to move a sensitive file through one.

Scanning content before a transfer completes

Channel-based controls check where data goes; content-aware controls check what it is. NIST SP 800-53 AC-4 covers filtering on both header information and message content, allowing a system to block, strip, modify, or quarantine data when a filter fails. Run that inspection at the endpoint on files and clipboard contents alike, because endpoint DLP tools that scan only saved files miss text a user pastes but never saves to disk.

Blocking risky destinations while keeping legitimate transfers moving

Blocking everything unfamiliar breeds workarounds, so target specific risky patterns instead, like regulated data headed to a personal account. A 2025 survey from MIND and the Enterprise Strategy Group (ESG) found that 47% of inspected DLP alerts are false positives.

Build destination rules around account context, since one ChatGPT URL serves both consumer and enterprise accounts. Graduated actions help too, since a block with a justification override records the business reason and keeps the transfer on a monitored path.

A policy can express that decision directly:

      IF content = regulated data AND account = personal
THEN block OR require justification override
      

NIST's principle of denying by default and allowing by exception (SC-7(5)) works when the exception list reflects how people work in practice.

Extending the same policy to AI tools

The rule that stops a customer list from reaching a personal Google Drive should also stop it from reaching Gemini's prompt box. A policy written only for file uploads and attachments misses pasted text in a chatbot's prompt field, which carries the same sensitive content through a channel most DLP configurations never cover. Cover typed text and attached files alike, and treat a chatbot's input box as one more exit point inside the same policy.

Mapping secure file transfer controls to what auditors expect

Auditors need evidence, usually logs, that a control ran on in-scope transfers, and availability alone provides incomplete evidence. A consistent content-aware policy across channels also gives teams one evidence model instead of a separate collection process for each exit path.

According to the Netwrix 2025 Cybersecurity Trends Report, 43% of organizations had unplanned expenses to address security shortfalls, so reusable control evidence can help teams avoid audit surprises and reactive remediation costs.

PCI DSS: Encrypting cardholder data in transit

PCI DSS v4.x Requirement 4.2.1 requires strong cryptography for primary account numbers (PANs) over open, public networks. This means trusted, valid certificates; secure protocol versions with no fallback; and at least 112 bits of effective key strength.

Assessors examine system configurations, the key and certificate inventory required by 4.2.1.1, and cardholder data transmissions as they occur. Requirement 10 logs all access to cardholder data, and blocked-transfer logs for personal email and USB can supplement that evidence by showing a PAN was stopped on another channel.

HIPAA: The Security Rule's transmission security standard

For electronic protected health information (ePHI), 45 CFR 164.312(e)(1) requires regulated entities to guard against unauthorized access to ePHI transmitted over an electronic network. Encryption under (e)(2)(ii) is addressable, meaning a regulated entity adopts it when a risk assessment finds it reasonable and appropriate, or documents an equivalent measure.

The Office for Civil Rights reviews the transmission policy, encryption standards, key management and the rationale for any shortfall. Logs of ePHI blocked from personal cloud and webmail can support that risk decision.

A proposed Security Rule update would require encryption of ePHI at rest and in transit, with limited exceptions. HHS lists final action as a July 2027 planning estimate.

GDPR: Article 32's appropriate technical measures

Article 32(1) of GDPR requires measures appropriate to the risk, including regular testing of their effectiveness. The UK Information Commissioner's Office (ICO) accepts correctly configured TLS 1.2 or 1.3, rejects SSL outright, and expects an encryption policy, key management documentation, and test results so controllers can prove the steps they have taken to comply.

The ICO's 2026 penalty against Police Scotland cited the force's own procedure requiring encryption of media in transit. Removable-media encryption records demonstrate that procedure in practice.

CMMC: Transmission confidentiality for CUI

NIST SP 800-171 Rev. 2 control 3.13.8 requires cryptographic mechanisms that prevent unauthorized disclosure of Controlled Unclassified Information (CUI) during transmission. Control 3.13.11 requires Federal Information Processing Standards (FIPS)-validated cryptography. SP 800-171A requires assessors to examine the security plan and configurations, review audit logs, interview administrators, and directly test the mechanisms.

The Cybersecurity Maturity Model Certification (CMMC) Level 2 Assessment Guide makes clear that using an approved algorithm alone is insufficient. It expects CUI encryption backed by policy and enforcement mechanisms, citing a proxy that blocks non-conforming traffic. A single objective marked not met fails the entire requirement. At the endpoint, blocked-transfer logs and USB encryption records show that same kind of enforcement.

How Netwrix supports secure file transfer in practice

Netwrix Endpoint Protector is an endpoint DLP product that blocks sensitive data uploads, controls removable media, and enforces content-aware policies across Windows, macOS, and Linux endpoints. It covers the exit paths a sanctioned transfer channel doesn't reach.

Scanning transfers for sensitive content before they complete

Netwrix Endpoint Protector's Content Aware Protection module inspects data at exit points, including browsers, email clients, webmail, cloud sync clients, and the clipboard. Its clipboard control deletes confidential content when it's copied, preventing it from being pasted. Logs export as Excel, PDF, or CSV and forward to a SIEM over syslog.

Enforcing encryption on removable media automatically

Netwrix Endpoint Protector's Enforced Encryption module applies FIPS 140-3 validated USB encryption with remote wipe and password reset. Deployment is automatic once a policy allows a USB device at Trusted Device Level 1 or above. Device Control covers USB storage and more than 45 peripheral classes, even offline. Enforced Encryption itself runs on Windows and macOS only; Device Control policies protect Linux endpoints instead.

NHS South East Coast Ambulance Service deployed Netwrix Endpoint Protector to meet the Data Security and Protection Toolkit (DSPT) requirements covering the devices its 4,000-plus staff carry across the region. According to Stewart Edwards, the trust's IT Security Manager, the rollout gave the team complete control over USB ports and devices while enforcing the encryption its compliance framework required.

Blocking sensitive uploads to AI tools

Netwrix Endpoint Protector extends the same content-aware policies to AI tools, covering ChatGPT, Microsoft Copilot, Google Gemini, Claude, DeepSeek, X AI Grok, and other listed tools. Coverage applies whether a user types sensitive content or attaches it as a file, and administrators can monitor or block that content before it reaches an unapproved provider.

Closing the distance between policy and practice

A secure file transfer decision should account for channel protection, visibility into bypass routes, endpoint enforcement, and consistent audit evidence. Security teams can establish a baseline by pulling a month of proxy logs for personal cloud and webmail domains, auditing removable storage on a sample of endpoints, and checking which AI domains users resolve.

Those findings show where to prioritize enforcement and apply the same content-aware policy at the point of transfer.

Request a demo to see how Netwrix helps organizations strengthen their data security posture by extending visibility and endpoint controls across sensitive data-transfer paths.