How can your business securely share files?

File sharing is part of everyday business. Employees send documents to colleagues, collaborate with customers, share information with suppliers and access files while working remotely. 

However, did you know that a simple sharing mistake could expose sensitive business information? It can create multiple unmanaged copies of a document or even give someone access for far longer than intended. 

Secure file sharing should make document collaboration easy while giving your business control over who can view, edit, download and share its data. 

 

How can you securely share files in your business? 

Secure file sharing combines secure business Identity Access Management (IAM) platforms with access permissions, multi-factor authentication, encryption, monitoring and clear business policies. It should also provide visibility over who has accessed a file, where and when changes were made and allow permissions to be changed or removed when they are no longer needed as part of a wider audit log in line with business compliance policies. 

The aim is not to stop people sharing files. Far from it. It’s to make sure that information is only shared with the right people, for the right purposes/uses, through the right platform, with the right level of protection for the data that is being shared and all whilst having this recorded for auditing purposes. 

 

What can go wrong when businesses share files? 

Poorly managed business file sharing policies can cause data security and compliance problems that could severely impact your business. 

Employees may use personal cloud storage accounts because they seem “more convenient” to them, or that they are already used to how it operates or just that they have a dual-purpose work/personal device. However, this moves company data outside your business tenancy (such as your Microsoft 365 environment), security policies, backup processes and above all… administrative control. 

For example, unrestricted file sharing links could be forwarded without the original sender knowing. Unless an expiry date has been applied, somebody may continue accessing the file long after they were originally shared a file, including former employees, employees who have changed roles or a customer relationship or supplier agreement has ended. Over time, this “permission creep” can mean that an unknown number of users could potentially have unrestricted access to files that contain sensitive business or client information. 

However, files may also be sent to the wrong person, shared with people using unmanaged or insecure devices or shared externally without an audit trail. Without clear ownership of your file sharing policies, the business may not know where its information is being accessed from, by who and who is responsible for protecting it. 

 

Are email attachments a secure form of file sharing? 

Email attachments are convenient, it is easy for your users to click the little paperclip and select a file that they have access to. However, when this happens, it creates an unmanaged copy of this data. 

Once a document has been sent via email, it may be downloaded to an external users’ device, saved to another business’s system or forwarded to other people without your knowledge. The original sender has limited visibility over what happens to that copy, how the data within the file is used or whether it is later deleted. 

Attachments can also create version control problems. Several employees may download and edit the same document, resulting in different versions containing conflicting or out of date information. 

Using a secure link to a shared document stored within a service such as Microsoft SharePoint or OneDrive can provide far greater control. The business can maintain one central version, update access permissions, limit access to only authorised people, only share for a specific period of time and, where appropriate, restrict editing or downloading. 

For particularly sensitive information shared with only trusted sources, email encryption and restrictions such as preventing forwarding may provide additional protection.  

 

What should secure file sharing include? 

Regardless of what is being shared, secure file access (and by extension sharing) should always begin with permission-based access. 

Employees, contractors and even external users should only be able to access the information they genuinely need and the impact of the data that is being shared should be understood by all in the business. This is known as the Principle of Least Privilege and reduces the damage that could be caused by a single compromised account or accidental sharing mistake. 

Multi-Factor Authentication protects user accounts and access to sensitive documents inside the business, however sharing files across platforms and outside of your business can mean that you lose control over the security requirements of your files. It is important to remember that a password alone is not enough protection if business/user login details are stolen through phishing, reused across platforms or exposed during a data breach. 

External sharing links should be limited wherever possible. Businesses may apply expiry dates, restrict recipients, enforce login to named users/email addresses and prevent files from being downloaded. Additional password protection for sensitive data may also provide an additional safeguard when supported, although the password should be shared through a different communication method. 

Sensitivity labels can help users understand whether information is public, internal or confidential. Additional Encryption and Data Loss Prevention policies can then apply additional controls to files containing personal, financial or commercially sensitive information. 

Audit logs are equally important. Your business should be able to see when a file was accessed, by who, when it was edited, downloaded or shared externally.  

 

How can Secure File Sharing be managed through Microsoft 365? 

Microsoft 365 can provide secure file sharing through SharePoint, OneDrive and Microsoft Teams, but only when the environment is configured and managed correctly in line with recommended business cyber security and compliance policies (such as Cyber Essentials Plus & ISO27001). 

SharePoint is well suited to departmental information, company resources and documents that need to remain available to the wider business.  

OneDrive is designed around an individual user and is useful for personal working files.  

Microsoft Teams provides a collaboration layer, with business and team shared files stored in SharePoint or OneDrive. 

These platforms allow employees to work collaboratively on a single document rather than emailing multiple attachments and keeping track of the latest version. They support version history, access controls, external sharing settings and auditing. 

However, simply by using Microsoft 365 it doesn’t mean that every file is automatically protected. 

External sharing may be too open, unrestricted links to files or folders may be available and users may store files in the wrong location. Old Teams workspaces, chat histories and SharePoint sites may also contain older users, guest accounts or permissions that have not been reviewed. 

Microsoft provides the tools, but your business still needs clear policies, appropriate configuration and ongoing management by experienced Microsoft experts to ensure that it works right for your business and is secure from being exposed to the outside world. 

 

How does Data Loss Prevention protect business data? 

Data Loss Prevention, often shortened to DLP, helps businesses identify and protect sensitive information across their tenancy. 

A properly configured Data Loss Prevention policy can detect certain types of confidential or sensitive data within SharePoint, OneDrive, Teams and other Microsoft 365 services. Depending on the rule, it may warn an employee, restrict external sharing or block an action completely. 

For example, Data Loss Prevention could be used to identify documents containing financial information, personal data or confidential client details. If someone attempts to share that information outside the business, additional controls can be applied. 

However, it is important to remember that Data Loss Prevention should not replace secure permissions through Policies of Least Privileged Access or employee training. Instead, it provides another layer of protection when a user makes a mistake or does not recognise that a document contains sensitive information. 

 

How does secure file sharing support compliance? 

Secure file sharing policies ensure that businesses demonstrate that they have appropriate controls over personal and confidential information. 

Under UK GDPR, businesses are responsible for protecting personal data against unauthorised access, accidental disclosure, loss or alteration. Sending information to the wrong recipient or leaving an unrestricted sharing link active could potentially create a data breach. 

Secure data access permissions, multi-factor authentication, audit logs and access reviews can also support businesses working towards Cyber Essentials and Cyber Essentials Plus. 

However, for ISO 27001, secure file sharing can contribute to wider controls covering data access management, information classification, data transfer, monitoring and documented responsibilities. 

Compliance with these industry recognised standards and regulations is not achieved by purchasing Microsoft 365 or enabling one security feature. Businesses must be able to show that their controls are actively managed, reviewed and supported by clear policies and employee awareness. Our Compliance Management service ensures that businesses can not only achieve certification for these standards, but maintain accreditation come audit and review. 

 

Why is employee training important? 

Technology and policies alone can’t prevent every file sharing mistake. At the end of the day… the people in your business are the weakest link in your cyber defence strategy. 

Employees may use personal storage accounts, unrestricted links or external third-party AI platforms because they appear easier than the approved process. They may also download files onto personal devices so they can continue working outside the office. 

These actions are not always malicious. In many cases they are innocent, employees are simply trying to complete a task quickly. However, even these innocent acts can represent big risks. 

Businesses need clear file sharing and usage policies and regular employee training around cyber and data security. Employees should understand which platforms they can use, how external sharing works and when additional approval may be required. 

Regular awareness is important as Privacy Fatigue can set in over time, especially with repeated warnings, constant phishing attempts, changes to workflows and maybe even confusing controls can cause employees to become less attentive to data protection policies over time. 

 

How can TwentyFour help your business securely share files? 

TwentyFour IT Services can help your business review and improve its secure file sharing policies and help your business to understand if there are any security vulnerabilities your business may yet be unaware of. 

We can assess your SharePoint, OneDrive and Teams environment to identify unrestricted links, unnecessary external access, outdated permissions, files stored in unsuitable shared locations and implement policies of least privileged access across your business. 

Our team can help structure SharePoint around your departments and business processes, giving documents and folders clear ownership and ensuring users can access only the information they need to effectively accomplish their role without receiving excessive permissions. Only elevating those permissions in line with privileged access policies when required. 

When your business is working towards Cyber Essentials, Cyber Essentials Plus or ISO 27001, our Compliance Management service can help connect these technical controls with the policies, evidence, auditing, training and reviews needed to maintain compliance. 

Secure file sharing is about control, visibility, security and accountability. Your team should be able to collaborate easily without losing control of your business data. 

If you are unsure who can access your documents, how many external sharing links exist or whether former employees and suppliers still have access, it may be time to review your file and folder management environment. Contact a member of our team to find out more. 

Enquire Here