Evaluating secure file sharing against an information security policy framework

File Sharing securely with external users and with adequate governance is hard. You might think you can just easily mandate a file sharing Software as a Service (SaaS) platform as part of your productivity suite, (Google Workspace has Google Drive, Microsoft 365 has Microsoft OneDrive, Apple has iCloud or there's always a third party SaaS like the venerable DropBox), but hold on before you do so. In exchange for a simple user experience you give up control over your data hosting to the cloud service provider. That might be fine for your organisation, and it is for a lot of organisations, but for some data workloads with sensitive, private or privileged data it could well not be acceptable.

Five reasons why a Software as a Service (SaaS) platform might fail your organisations criteria for secure file sharing technology

There are probably more but here are five:

1. Firstly, SaaS providers might be required to give access to their data to other agencies by regulation or for other reasons although like DropBox they may appear to be transparent about it.
2. Secondly, they might index your content as Windows does if you let it by enabling "Cloud content search", leading to the potential for serving information in search results to users who should not be able to see it.
3. Thirdly, your SaaS provider might harvest the data for use in training a large language model (LLM) for Artificial Intelligence (AI), with the resulting risk posited by Google that training data appears in output or could be subject to a training data extraction attack.
4. Fourthly, they might change their terms and conditions or like Skiff be acquired and shut down.
5. In extreme cases, (looking at you, Amazon Drive), they may just throw in the towel and cease operating the service altogether.

Evaluating secure file sharing against an information security policy framework

Recently, we conducted an evaluation of secure file sharing technology for suitability for sharing securely with users both internal and external to an organisation in a regulated market sector. This was an interesting exercise, which made us spend further time thinking about the issues around secure sharing of company information in the cloud, and the almost automatic use these days of the technologies tied to an organisations business cloud software provider. The criteria we set were informed by our own information security policy framework as we look to become ISO27001 certified.  

Information Security Criteria

Whatever system is chosen must preserve information security. It should ensure that access to the system is only given to the right people, to the right data, and at the right time.

• Access Control – Measures to control who can access the data and what actions they can perform.
• Authentication – Authentication, authorisation and revocation mechanisms strong enough to verify the identity of users accessing the service.
• Auditing and Logging – Detailed logs of all activities and accesses to the data, allowing for accountability and traceability.
• Incident Response – Procedures to respond and mitigate changes, continuity, disaster, security incidents or breaches.
• Data Encryption – Encryption to protect data from unauthorized access.
• Data Integrity – Maintenance and assurance of data over its entire life-cycle.
• Data Deletion and Disposal – Supports procedures for securely deleting and disposing of data when it is no longer needed.
• Data Governance – Policies and procedures for the proper management and use of data within the organization.
• Data Classification – Data classification based on its sensitivity.
• Network Security – Prevention of unauthorized access and protection against external threats.
• Vendor Risk Management – Assessment and management of security risks associated with third-party vendors or partners involved in the data sharing process.
• User Training and Awareness – Education available to users about security best practices to help prevent security incidents.
• Secure Development Lifecycle – Security in the software development process must be respected.
• Security Monitoring – Tools and processes for continuous monitoring of the service and its environment for potential security issues.
• Compliance and Regulatory Requirements – Ensure that the service complies with relevant laws, regulations, and industry standards.

Functionality and ease of use

Functionality and ease of use only matters if the information security criteria are met. 

• Ease of use – There should be a fully featured web App, Windows, Mac desktop drive/volume level support is desirable, folder level support acceptable. iOS and Android Apps are highly desirable.
• Functionality – Branded Portal, Let's Encrypt SSL support, Custom URL, Shared Files and Folders, (password protection, public, time timited), Unlimited storage. Comprehensive email notifications. 

No system guarantees everything in an information security policy

This exercise is not about criticising systems that cannot guarantee total  compliance with information security policies. None are perfect, It is more to show that if information security cannot be guaranteed then the risks should be quantified, written down, subject to regular review and accepted by the executive management of the business. 

TL:DR: Operating system vendor solutions and well known SaaS services cannot easily be made to satisfy all of these conditions. The only way to guarantee compliance with strict information security policies is to self host with a technology and platform that enables you to encrypt your data in transit and at rest. You have to have the keys to the kingdom!

 Detailed secure file sharing service evaluation against an information security policy framework

Features, functionality and ease of use are important, but information security is a pre-requisite.

Information Security

Information Security is about ensuring that the right people have the right access to the right data at the right time. This is achieved through:

• Confidentiality – Access to information is only to those with appropriate authority
• Integrity – Information that is complete and accurate, for the purpose needed
• Availability – Making sure information is available when it is needed

This table compares the major file sharing platforms we are interested in, against our information security policy requirements. 

Access Control

Authentication

Auditing and Logging

Incident Response

Data Encryption

Data Integrity

Data Deletion and Disposal

Data Governance

Data Classification

Network Security

Vendor Risk Management

User Training and Awareness

Secure Development Lifecycle