The File Sharing Challenge

Businesses need to share files constantly — with colleagues, clients, vendors, and partners. The challenge is doing so securely without creating friction that leads to workarounds.

Poor file sharing practices lead to data exposure, compliance violations, and security breaches. Good practices protect your business while enabling collaboration.

Understanding the Risks

Data Exposure

Files going where they should not:

Sharing with wrong recipients
Links accessed by unintended parties
Public sharing when private was intended
Data remaining accessible after relationship ends

Security Threats

Malicious activity:

Malware distributed through file sharing
Phishing using file sharing platforms
Account compromise exposing shared content
Man-in-the-middle attacks on transfers

Compliance Issues

Regulatory concerns:

Personal data shared inappropriately
Insufficient access controls for sensitive data
Lack of audit trails for regulated information
Data crossing geographic boundaries inappropriately

Version and Control Problems

Operational issues:

Wrong versions being used
Lost changes from conflicting edits
No visibility into who has what
Data in too many places

Secure Sharing Options

Cloud Storage Platforms

Centralised file sharing:

Microsoft OneDrive/SharePoint:

Integrated with Microsoft 365
Granular permissions
Version history
Expiring and password-protected links
Audit logging

Google Drive:

Integrated with Google Workspace
Easy sharing and collaboration
Link sharing with controls
Version history

Dropbox:

Platform-agnostic
Easy external sharing
Team folders and permissions
Paper trail and audit features

Secure File Transfer Services

For larger or more sensitive files:

Dedicated transfer servicesDesigned for secure delivery of large files.

FeaturesEncryption, expiring links, download notifications, password protection.

Use casesLarge files, sensitive content, formal document delivery.

Email Attachments

Traditional but limited:

ProsFamiliar, universal, creates record.

ConsSize limits, security depends on email security, version control issues.

Best practicesUse for small, non-sensitive files. Consider links to cloud storage instead.

Encrypted Transfer

For highly sensitive content:

End-to-end encryptionContent protected from sender to recipient.

Password-protected filesAdditional layer on top of transfer encryption.

Secure emailEncrypted email services for sensitive communication.

Best Practices

Access Controls

Managing who can access what:

Principle of least privilegeShare only with those who need access.

Time-limited accessExpiring links and permissions where appropriate.

View vs editGive edit access only when needed.

Regular reviewPeriodic audit of sharing and permissions.

Link Sharing

When sharing via links:

Prefer specific sharingNamed users rather than "anyone with link" when possible.

Expiring linksSet expiration for external sharing.

Password protectionAdditional security for sensitive content.

Disable downloadView-only when download is not needed.

External Sharing

Sharing outside your organisation:

Clear policiesGuidelines on what can be shared externally.

Approved platformsDesignated tools for external sharing.

Audit trailVisibility into what is shared with whom.

RevocationAbility to remove access when no longer needed.

Sensitive Data

Extra care for confidential content:

ClassificationKnow what is sensitive before sharing.

Appropriate methodsUse secure methods for sensitive content.

EncryptionAdditional protection for highly confidential material.

Minimise sharingShare only what is necessary.

Platform Configuration

Microsoft 365

Configuring secure sharing:

SharePoint sharing settingsControl external sharing permissions.

Sensitivity labelsClassify and protect content.

Conditional accessRequire compliant devices for access.

DLP policiesPrevent sharing of sensitive content types.

Audit loggingTrack sharing activity.

Google Workspace

Google sharing controls:

Sharing settingsOrganisation-wide defaults.

Drive labelsClassification and protection.

Target audienceControl sharing scope.

Activity dashboardVisibility into sharing.

General Controls

Across any platform:

Default settingsSecure defaults for new sharing.

Admin oversightVisibility into sharing activity.

User trainingAwareness of secure sharing practices.

Regular reviewsPeriodic assessment of sharing permissions.

Common Scenarios

Sharing with Clients

External business sharing:

Use professional sharing platforms
Set appropriate permissions (view/download/edit)
Consider expiring links for time-sensitive content
Maintain visibility into client access
Revoke access when project ends

Internal Collaboration

Team file sharing:

Centralised storage with appropriate structure
Clear folder and file organisation
Appropriate permissions by team and role
Version control for collaborative documents
Guidelines on folder usage

Receiving Files

Files coming to you:

Secure upload portals for external parties
Scanning for malware on received files
Clear process for handling incoming files
Appropriate storage for received content

Large File Transfer

When files exceed email limits:

Use cloud storage links
Secure transfer services for sensitive content
Consider compression for very large files
Verify successful delivery

Implementation

Policy Development

Creating sharing guidelines:

ClassificationWhat types of data require what protection?

Approved methodsWhich tools for which scenarios?

External sharingWhen and how is external sharing permitted?

RetentionHow long should shared content remain accessible?

ResponsibilitiesWho manages sharing and access?

User Training

Building secure habits:

Understanding sharing options and risks
Choosing appropriate sharing methods
Using platform security features
Recognising and avoiding insecure practices
Reporting concerns

Technical Controls

Enforcing policy:

Platform configuration to enable secure sharing
Default settings aligned with policy
Monitoring and alerting for risky sharing
DLP tools where appropriate
Regular configuration review

Monitoring and Review

Ongoing oversight:

Audit of sharing activity
Regular permission reviews
Incident investigation when problems occur
Policy updates based on experience

Avoiding Common Mistakes

Defaulting to Open Sharing

Too permissive settings:

"Anyone with link" when specific sharing is appropriate
Edit access when view-only is sufficient
No expiration on external shares
Forgotten shares remaining accessible

Using Consumer Tools

Inappropriate platforms:

Personal accounts for business sharing
Consumer file sharing services for sensitive data
Tools without adequate security features
Platforms outside IT visibility

Ignoring Revocation

Access that outlives need:

Former staff retaining access
Former clients with continued access
Project shares remaining after completion
No process for regular cleanup

Sharing Without Thinking

Reflexive sharing:

Sharing sensitive content via insecure methods
Not verifying recipient before sharing
Sharing more than necessary
Not considering who else might access

Secure file sharing balances security with usability. Get the balance right, and your business can collaborate effectively while protecting its information.