Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

One of my customers wants to make sure that when someone downloads a file from their website the file being downloaded is secure from third parties capturing the downloaded information. Their site is IIS and is using a SSL certificate.

My question is, are there any other issues I need to be aware of, or, is this enough to protect their customers whom download these files?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

Using an SSL certificate will encrypt the communication between client browsers and your website. Depending on how serious your client is about security, two questions that you might want to further consider for downloads are:

1). Can a hacker replace download files with deleterious ones?

If the files are added to your site via FTP or share a common directory with it, then you'll want to spend some time making sure that's secure. The following list of articles might be helpful:
How Do I Configure FTP Security in IIS?

If files are uploaded to your server through server-side scripts or applications, then you'll want to make sure that those are secure as well. This is dependent on the script/application that you use - search for common exploits for those.

You'll also want to make sure access to your server through Remote Desktop Services is disabled unless needed: Disabling Remote Desktop Services features

Lastly, you might want to review other areas of security for IIS: Configuring Security

2). Is the file downloaded the same as the original one?

Some sites list an MD5 or SHA1 hash value of files so that users can verify that the file hasn't been modified. See this for more on that:
Microsoft - How to compute the MD5 or SHA-1 cryptographic hash values for a file

Clients can then use the File Checksum Integrity Verifier (FCIV) utility (or other similar tool) to verify the hash value, as available for download and discussed here:
Microsoft - Availability and description of the File Checksum Integrity Verifier utility

share|improve this answer
    
The client is putting the files on the site, so I am not concerned about that. What I am afraid of is that there might be some way to intercept or capture the file information as it is being downloaded. I have heard of man-in-the middle attacks, but is there some other potential way a hacker could get the downloaded file? –  Wade73 Sep 2 '13 at 19:28
1  
There's not much to be concerned with while the file is in transit over SSL - after all, this is the same cryptography that banks use. The areas to be concerned with are who can access the files on the server (i.e., user authentication, and server security as covered above). Once the file is downloaded, other than confirming the file hasn't been altered (as covered above), there's not much else you can do except encrypt the file on the server and provide a decryption key/tool for clients. –  dan Sep 2 '13 at 20:10
    
Thanks for the information, I really appreciate it! –  Wade73 Sep 3 '13 at 0:00
    
No problem - good luck :-) –  dan Sep 3 '13 at 0:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.