The Problem with Email Attachments
Email remains the default for sending documents, but standard email has limitations:
No encryptionUnless specifically configured, email travels without encryption.
No access controlOnce sent, you can't revoke access.
No trackingYou don't know if or when recipients accessed files.
Size limitsLarge files may be blocked or cause problems.
Version confusionRecipients may have outdated versions.
For sensitive documents, better options exist.
Understanding Your Options
Encrypted Email
Email with encryption applied:
S/MIME and PGPEnd-to-end encryption using certificates. Complex to set up but secure.
Transport layer security (TLS)Encrypts email in transit but not at rest.
Portal-based encryptionRecipients access encrypted messages via web portal.
Encrypted email works when configured correctly but adds complexity.
Cloud Storage Sharing
Sharing via cloud platforms (OneDrive, Google Drive, Dropbox, etc.):
Advantages:
- Large files handled easily
- Access can be revoked
- Activity tracking available
- Version control
- No mailbox storage consumed
Considerations:
- Recipient needs account (or uses links)
- Data stored in cloud
- Sharing settings need careful configuration
Secure File Transfer Services
Purpose-built secure sharing:
Features often include:
- Encryption in transit and at rest
- Link expiration
- Password protection
- Download tracking
- Access logging
Options range from free consumer services to enterprise platforms.
Encrypted Containers
Encrypting files before sending:
Password-protected archivesZip files with passwords. Better than nothing but not highly secure.
Encrypted containersTools like VeraCrypt create encrypted volumes. Strong but requires recipient to have software.
Choosing the Right Method
Consider:
SensitivityHow damaging would disclosure be?
Recipient capabilityWhat can recipients reasonably handle?
Regulatory requirementsDo compliance obligations mandate specific methods?
Audit needsDo you need proof of delivery and access?
Low Sensitivity Internal
Standard email or cloud sharing usually adequate.
Moderate Sensitivity
Cloud sharing with appropriate settings:
- Link expiration
- Password if external
- View-only if appropriate
High Sensitivity
Purpose-built secure transfer:
- Encryption required
- Access tracking
- Expiring access
- Audit logging
Regulated Information
Follow specific regulatory requirements:
- Health information may require specific safeguards
- Financial data may have industry standards
- Check applicable requirements
Cloud Sharing Best Practices
When using cloud platforms for sharing:
Access Controls
Specific recipientsShare with identified people rather than "anyone with link" when possible.
Minimum permissionsView-only unless editing is needed.
ExpirationSet links to expire after reasonable period.
Password protectionAdd passwords for external sharing of sensitive documents.
Sharing Settings
Check before sharingReview what permissions you're granting.
Audit sharingPeriodically review what's shared and with whom.
Revoke when doneRemove access when no longer needed.
Organisation
Sharing foldersDedicated folders for external sharing simplify management.
Naming conventionsClear naming helps everyone understand what's shared.
Avoid personal accountsUse business accounts with appropriate controls.
Common Mistakes
Over-reliance on "Anyone with Link"
Convenient but dangerous for sensitive files. Links can be forwarded, and access can't be tracked or revoked easily.
Ignoring Download vs. View
View-only access prevents downloading in the platform, but determined recipients can still capture content.
Forgotten Shares
Links shared months ago may still be active. Regular review is essential.
Wrong Recipient
Double-check recipient addresses. Autofill suggestions can cause misdirected shares.
Unencrypted Passwords
Sending password in same email as encrypted file defeats the purpose. Use different channel for passwords.
Enterprise Considerations
Larger organisations may need:
Data Loss Prevention (DLP)Automatically detect and protect sensitive information.
Information Rights Management (IRM)Controls that follow documents after sharing.
Secure transfer platformsEnterprise-grade solutions with full audit trails.
Policy enforcementTechnical controls preventing inappropriate sharing.
Receiving Secure Files
When receiving sensitive files:
Verify senderConfirm requests through independent channels if unexpected.
Check linksHover before clicking to verify destination.
Use caution with passwordsLegitimate senders won't include passwords in same message as encrypted files.
Download to secure locationDon't save sensitive files to personal devices.
Building Good Habits
Default to secureMake secure sharing the easy option.
Question emailPause before attaching sensitive files to email.
Review permissionsCheck what you're sharing before sending.
Follow upRemove access when sharing purpose is complete.
Secure file sharing doesn't have to be complex. Choosing appropriate methods for different situations and following basic practices protects sensitive information effectively.