Information security is commonly described using three terms:

• confidentiality - ensuring the privacy of sensitive information
• integrity - ensuring that information and programs are changed only in a specified and authorised manner; and
• availability - ensuring that systems work promptly and that service is not denied to authorised users.

The terms are usually thought of as three attributes of information security that are always present. This is similar to the fire triangel - heat, air, and flamable material - all three must be present to create a fire. To create information security you need to consider confidentiality, integrity and availability.

The reason I bring this up in regards to FTP and firewalls, is to point out that the second term - integrity - is technically difficult to accomplish using active FTP, because FTP servers tries to connect to your FTP client while your firewall should stop connections from foreign sources to arbitrary ports. By using passive mode, the integrity of your firewall is not broken, because both the control channel and data channel is initiated by authorised personell from the inside to the outside. Firewall usually allow external responses to queries initiated from the inside to pass through.