File transfer systems should be placed behind a VPN or zero-trust access architecture wherever possible to avoid direct exposure to the internet.