FTC Released a Guide Peer-to-Peer File Sharing: A Guide for Business (January 2010)

The FTC Released a Guide for Peer-to-Peer File Sharing: A Guide for Business

Janurary 2010

The Federal Trade Commission (“FTC”) released a guide Peer-to-Peer File Sharing: A Guide for Business, which addresses the security risks associated with using Peer-to-Peer (P2P) file sharing software in businesses that handle sensitive information. Here's a summary of the main points:

Overview of P2P File Sharing

• Definition. P2P technology allows users to share digital files (e.g., music, documents) directly between computers connected to the same network.

• Examples. Common P2P programs include BearShare, LimeWire, and BitTorrent.

Security Risks

• Improperly configured P2P software can expose sensitive files, including personal and financial information, to unintended users on the network.

• Accidental sharing can occur if users mistakenly share entire drives or folders containing confidential data.

• Viruses and malware can compromise the integrity of shared files, increasing the risk of sensitive information being leaked.

Recommendations for Protecting Sensitive Information

1. Data Management. Delete unnecessary sensitive information and restrict storage locations for sensitive files.

2. Minimize P2P Use. Limit or eliminate P2P software on devices that access sensitive information.

3. Monitoring and Blocking. Regularly monitor the network for unauthorized P2P software and block traffic associated with such programs.

4. Employee Training. Educate employees about the risks associated with P2P file sharing and enforce security policies.

Policy Decisions

• Businesses must decide whether to ban or allow P2P file sharing based on their specific needs and the sensitivity of the data they handle.

• Policies should include how to prevent unauthorized P2P installations, detect existing software, and protect sensitive files if P2P is permitted.

Implementation Strategies

• If Banning P2P.

  • Block access to download sites and prevent installations of unapproved software.

  • Use scanning tools to detect and remove any unauthorized P2P applications.

• If Allowing P2P.

• Choose a single, secure P2P program and provide it directly to users from an internal source.

• Control the types of files shared and monitor network traffic for sensitive data.

Remote Access Considerations

• When providing remote access, use secure connections (e.g., VPN) and provide dedicated company computers with appropriate security measures.

• Train remote users about secure practices for handling sensitive information.

Employee Responsibility

• All employees should understand the importance of protecting sensitive information and be trained on how to manage risks associated with P2P software.

Policy Evaluation

• Regularly review and update security measures to address changing circumstances and technology to maintain effective protection of sensitive information.

Overall, the guide emphasizes the critical need for businesses to assess their use of P2P file sharing and implement strong security measures to safeguard sensitive information.

 

For more information, see here:  https://www.ftc.gov/tips-advice/business-center/guidance/peer-peer-file-sharing-guide-business

 

These materials were obtained directly from the Federal Government public websites and are posted here for your review and reference only.  No Claim to Original U.S. Government Works.  These may not be the most recent versions.  The U.S. Government may have more current information.  We make no guarantees or warranties about the accuracy or completeness of this information, or the information linked to.  Please check the linked sources directly.