Beastro – MOVEit SFTP Security Overview

Beastro leverages MOVEit Managed File Transfer (MFT) to ensure secure, compliant, and reliable handling of sensitive data. MOVEit provides multiple layers of protection that safeguard files during transfer, storage, and processing. The following sections outline the key security features available.

In‑Transit Encryption

MOVEit protects all data transmitted between clients and the server through strong encrypted channels.

How It Works

• MOVEit uses SSL/SSH to encrypt all communications during transport.

Storage Encryption

MOVEit ensures that files remain protected even after transfer, using industry‑approved encryption standards.

How It Works

• All files stored on disk are encrypted using FIPS 140‑2 validated 256‑bit AES, the U.S. federal standard for secure encryption.
• MOVEit uses MOVEit Crypto, a cryptographic engine certified by both U.S. and Canadian governments under FIPS 140‑2 guidelines.
• When files are deleted, MOVEit overwrites them with random bytes, ensuring encrypted data cannot remain on disk after deletion.

Reference:

(FIPS 197, Advanced Encryption Standard (AES) | CSRC )

Secure Transport‑to‑Storage Handling

MOVEit minimizes exposure of sensitive data during the transition from network transport to encrypted storage.

Key Protections

• MOVEit does not load entire uploaded files into large clear‑text memory buffers (which could be vulnerable to malware “sniffing”).
• Instead, it uses small spooled buffers, encrypting file chunks and writing them to disk immediately.
• This approach reduces:
  1. The amount of data exposed at any moment.
  2. The time window in which data is vulnerable.

This method also provides performance benefits by reducing memory usage.

Why Not Store Files Using SSL/SSH Directly?

SSL/SSH sessions use temporary keys renegotiated with each connection. MOVEit requires persistent cryptographic keys for secure, long‑term storage—something SSL/SSH cannot provide.

File Integrity Checking

MOVEit can validate that transferred files arrive exactly as they were sent.

How It Works

• MOVEit’s secure FTP, API, and web‑based clients support integrity checking, ensuring file contents were not altered in transit.
• During the final step of transfer:
  • Both client and server independently compute a cryptographic hash of the file.
  • If the hashes match, the transfer is confirmed as authentic and unchanged.
• Results of integrity checks:
  • Are displayed to the user.
  • Are stored on the MOVEit server for auditing and review.

Summary

MOVEit provides Beastro with a strong security framework that protects sensitive data throughout its lifecycle:

• Encrypted in transit with SSL/SSH
• Encrypted at rest with FIPS 140‑2 validated AES‑256
• Secure handling during the transition from transfer to storage
• Integrity validation to ensure files are unchanged

These features operate in addition to system‑level hardening and secure application services, giving Beastro a robust and compliant file‑transfer environment.

Sources:

• Security/Data Protection