Partners get in.Scanners don’t.
File transfer servers hold the data attackers want and sit where everyone can find them.
Partners need to reach it.So does everyone else.
A transfer server is exposed by design, because partners have to reach it. That makes it a standing target, and the files on it are frequently the most sensitive an organisation moves.
Partners have to connect, so the server answers the whole internet.
It narrows who connects. The service still listens, including to a compromised partner address.
Managed file transfer flaws have been mass-exploited in the window between disclosure and patching.
The transfers keep running.The listener is gone.
The port is closed.Not hidden.
SSHepherd closes the listening port on the transfer host, so the service cannot be discovered or reached by an unauthorised party.
Authorised partners and internal systems connect through the broker, which admits known identities only. The transfer service keeps running; it simply stops answering the open internet.
Only authorised identities are admitted. Every session can be monitored, recorded and ended on demand.
Developed by Full Armor Corporation. Distributed, deployed and supported across Southeast Asia by Auris.
- Nothing listens inbound
- Access via broker only
- Every session monitored
Your team keeps working.Scanners get nothing.
Authorised partner and internal transfers run as before.
An unreachable service cannot be mass-exploited on the day a flaw is disclosed.
Partners are admitted individually rather than by IP allow-list.
Transfers are recorded and exportable for audit.
Watch it work.
Harden your SFTP servers: make them invisible to hackers. A recorded demo from Full Armor, the developer of SSHepherd®.
Common questions.
Can external partners still send us files?
Yes. Authorised partners connect through the broker. The difference is that only known identities can reach the service at all, instead of it answering anyone who scans for it.
Does this work with our existing MFT product?
In most cases yes. SSHepherd closes the port in front of the service rather than replacing it, so the transfer software itself is unchanged.
Is this better than an IP allow-list?
It is a different control and a stronger one. An allow-list still leaves the service listening and reachable from any permitted address, including a compromised one. SSHepherd removes the listener and binds access to an authorised identity.
See it onyour own servers.
Tell us roughly what you run: how many servers, and whether they are on-premise or in the cloud. We will set up a demo with an engineer and reply within one business day.