File transfers, with no open port.
File transfer servers hold the data attackers want and sit where everyone can find them.
What an open file transfers port gives away
A transfer server is exposed by design, because partners have to reach it. That makes it a standing target, and the files on it are frequently the most sensitive an organisation moves.
Managed file transfer software has been the subject of some of the most damaging mass-exploitation campaigns in recent years. In each case the pattern was the same: a reachable service, a newly disclosed flaw, and a window between disclosure and patching that attackers moved through faster than defenders.
The port is closed, not hidden.
SSHepherd closes the listening port on the transfer host, so the service cannot be discovered or reached by an unauthorised party.
Authorised partners and internal systems connect through the broker, which admits known identities only. The transfer service keeps running; it simply stops answering the open internet.
- Nothing listens inbound
- Access via broker only
- Every session monitored
What your customer notices
Authorised partner and internal transfers run as before.
An unreachable service cannot be mass-exploited on the day a flaw is disclosed.
Partners are admitted individually rather than by IP allow-list.
Transfers are recorded and exportable for audit.
Watch the file transfers demo.
Harden your SFTP servers: make them invisible to hackers. A recorded demo from Full Armor, the developer of SSHepherd®.
File transfers: common questions
Can external partners still send us files?
Yes. Authorised partners connect through the broker. The difference is that only known identities can reach the service at all, instead of it answering anyone who scans for it.
Does this work with our existing MFT product?
In most cases yes. SSHepherd closes the port in front of the service rather than replacing it, so the transfer software itself is unchanged.
Is this better than an IP allow-list?
It is a different control and a stronger one. An allow-list still leaves the service listening and reachable from any permitted address, including a compromised one. SSHepherd removes the listener and binds access to an authorised identity.