SE571
Principles of Information Security and Privacy
Course Project
FTP- File Transfer Protocol

12/02/2011

Company Overview MedAssets provides technology solutions and consulting services to cover the full spectrum of providers’ revenue cycle needs from patient access to claims denials. In addition, MedAssets’ decision support suite integrates financial, clinical and administrative information, and then distributes that data enterprise wide for timely analysis and decision making to positively impact future performance. All of these solutions help ensure your facility gets paid fairly, in a timely manner, for services rendered; which could potentially improve your net patient revenue 1-3%.
Revenue Capture Solutions/ Value proposition MedAssets’ revenue capture solutions help establish and sustain revenue integrity by identifying missed charges, improving clinical documentation and providing tools for case management, all working to transform the revenue cycle and yield increases in the bottom line. Whether working with a large integrated delivery network or a small rural hospital, as a knowledgeable strategic business partner, MedAssets can replace multiple vendors and build a customized, multi-year program, using technology and know-how to help your facility achieve your financial and operational goals.
File Transfer Protocol The File Transfer Protocol (FTP) allows clients to access remote file servers, list remote directories, and move files to or from remote hosts. FTP understands basic file formats and can transfer files in ASCII character or binary format. Defined in STD 9/RFC 959, FTP provides a standard UNIX-like user interface, regardless of the actual underlying operating system. FTP allows a client to upload a file to a remote host, download a file from a remote host, or move files between two remote hosts. FTP was defined to allow file transfers between two systems without giving the user all of the capabilities that a Telnet session would (e.g., the ability to execute programs at the remote host). In some ways, FTP is more complex than Telnet. FTP maintains separate TCP connections for control and data transfer. FTP commands and responses are exchanged on the control connection, and a new data connection is established by the server for each directory listing or file transfer.

MedAssets FTP/sFTP Initial Account Setup Request and Notification Implementation Managers are responsible for initiating and confirming the initial FTP/sFTP account setup from the MDAS FTP Support group. The Implementation Manager will subsequently be responsible for notifying the project’s assigned Technical Implementation Analyst upon data receipt. Finally, at the end of the Implementation, during the Transition to Client Services, data receipt notification should be requested to be turned off.

Login FTP login utilizes a normal username/password scheme for granting access. The username is sent to the server using the USER command, and the password is sent using the PASS command. If the information provided by the client is accepted by the server, the server will send a greeting to the client and the session will be open. If the server supports it, clients may log in without providing login credentials. The server will also limit access for that session based on what the user is authorized.
Client File Submission Methodology

Account Name:
Password:

Secure FTP
All data is sent to MedAssets via Secure FTP using one of the following secure methods. PHI (Patient Health Information) data does not need to be encrypted when using Secure FTP. * Connect to sftp.medassets.com using one of the following protocols: * Implicit FTPS (SSL) on port 990 * PASV Mode connections allowed on ports 28000 – 28050 * SFTP (SSH2) on port 22 * Authentication options: * Username + password * Username + public key (public key provided by hospital)

Standard FTP * NOTE: Standard FTP is ONLY to be used in the rare instance when the organization is limited in some unique way from being able to send via Secure FTP. * NOTE: All PHI data must be encrypted if sending via Standard FTP. * Port 21 using Standard FTP client to connect to ftp.medassets.com

Security
FTP was not designed to be a secure protocol—especially by today's standards—and has many security weaknesses.
Bounce attacks
Spoof attacks
Brute force attacks
Packet capture (sniffing)
Username protection
Port stealing FTP was not designed to encrypt its traffic; all transmissions are in clear text, and user names, passwords, commands and data can be easily read by anyone able to perform packet capture (sniffing) on the network. Below is a link from you tube about FTP for additional information http://www.youtube.com/watch?v=hiQrYptlZ08