Certified File Transfer Professional (CFTP) Official Study Guide Version 1.3 Page 1 of 89 Copyright 2018 Pro2col Ltd. - All Rights Reserved Do Not Copy or Distribute Without Written Permission – More Information at Pro2col.com Certified File Transfer Professional (CFTP) - Official CFTP Study Guide – Version 1.3 Table of Contents Table of Contents ........................................................................................................................................ 2 I. Introduction to CFTP ............................................................................................................................... 6 CFTP Certifying Body ................................................................................................................................................ 6 CFTP Training and Test Procedure ........................................................................................................................... 6 II. File Transfer Concepts ........................................................................................................................... 6 When File Transfer Should Be Used ......................................................................................................................... 6 When File Transfer Should NOT Be Used ................................................................................................................. 7 File Transfer’s Role in Collaboration .......................................................................................................................... 7 File Transfer Client and Server Concepts .................................................................................................................. 8 “Data in Motion” and “Data at Rest” Encryption Concepts ......................................................................................... 9 Encryption Concepts ................................................................................................................................................ 10 Symmetric Encryption ............................................................................................................................................................ 10 Asymmetric Encryption .......................................................................................................................................................... 11 Common Encryption Algorithms ............................................................................................................................................. 12 Hashing Concepts ................................................................................................................................................... 13 Common Hash Algorithms ..................................................................................................................................................... 14 Salting Hashes ....................................................................................................................................................................... 15 Providing Integrity Checks ...................................................................................................................................................... 16 PKI (Public-Key Infrastructure) Concepts ................................................................................................................ 17 Role in Security in Transit ...................................................................................................................................................... 18 Role in Security at Rest .......................................................................................................................................................... 18 Obtaining a Certificate ............................................................................................................................................................ 18 IPv4 and IPv6 .......................................................................................................................................................... 20 Private vs. Public Addresses .................................................................................................................................................. 20 Network Address Translation ................................................................................................................................................. 21 Proxies ..................................................................................................................................................................... 21 Reverse Proxy ....................................................................................................................................................................... 21 Forward Proxy........................................................................................................................................................................ 21 III. Basic File Transfer Protocols ............................................................................................................. 22 FTP .......................................................................................................................................................................... 22 Active Mode ........................................................................................................................................................................... 24 Passive Mode (or “Firewall Friendly”) ..................................................................................................................................... 25 ASCII / Binary / EBCDIC Formatting ...................................................................................................................................... 26 Custom “Quote” Commands .................................................................................................................................................. 27 EPSV and EPRT .................................................................................................................................................................... 28 Integrity Checks ..................................................................................................................................................................... 29 FTPS (SSL/TLS) ...................................................................................................................................................... 30 FTPS “Explicit” or “RFC-Compliant” Mode .............................................................................................................................. 30 FTPS “Implicit” Mode ............................................................................................................................................................. 31 Page 2 of 89 Copyright 2018 Pro2col Ltd. - All Rights Reserved Do Not Copy or Distribute Without Written Permission – More Information at Pro2col.com Certified File Transfer Professional (CFTP) - Official CFTP Study Guide – Version 1.3 FTPS vs. Firewalls and NAT .................................................................................................................................................. 32 Strong Authentication (via Certificates) .................................................................................................................................. 33 SFTP (SSH) ............................................................................................................................................................. 34 SFTP vs. “FTP Tunneled Over SSH” ...................................................................................................................................... 34 Strong Authentication (via Keys) ............................................................................................................................................ 35 SCP (SSH)............................................................................................................................................................... 36 IV. Advanced File Transfer Protocols ..................................................................................................... 37 HTTP ....................................................................................................................................................................... 37 HTTP URLs ........................................................................................................................................................................... 37 “Non-URL” HTTP Parameters ................................................................................................................................................ 38 HTTP Security........................................................................................................................................................................ 38 HTTP File Uploads ................................................................................................................................................................. 38 HTTP Advanced File Uploads ................................................................................................................................................ 39 HTTPS (SSL/TLS) ..................................................................................................................................................