Link Sharing options in G Suite - check your settings!

[enjay]

Google has an odd default sharing option - when you paste a link to a document into an email, if the recipient of that email doesn't already have access, Google offers to make the document available to anyone who has the link rather than just the recipients of the email. This could result in unintentionally data sharing or breaches.

 

This setting can be changed so it will instead just grant access to the email's recipients, i.e. the intended audience for the document! Instructions at https://support.google.com/a/answer/60781?hl=en (scroll down to "access checker").

 

Hopefully you all already know this, but just in case you also have Google's default still enabled, I thought I'd share this.

[Ditto]

I have a slightly different understanding. The default sharing of 'Anyone with the link' (within the domain is also a normal requirement), all you are doing by emailing is notifying some users what the link is. Everyone else always had share options, they just wouldn't have the link. The sharing in Google does take some getting used too and there are some things that baffle me. Try one thing for me as I have an open support case. When on your Google drive, click 'Shared with me'. Is what you see expected?

[enjay]

I have a slightly different understanding. The default sharing of 'Anyone with the link' (within the domain is also a normal requirement), all you are doing by emailing is notifying some users what the link is.

 

Perhaps true, but we've had instances of students "requesting access" to documents which had been shared in this way, so while they didn't have access without the link, they had somehow been notified of the existence of the document - perhaps via a search? This could be a problem depending on what the document/folder was called. If, for example, it was called "Disciplinary action proposal against enjay" it could be problematic if I became alerted to the presence of that document, especially if I didn't know such action was being considered. Does that make sense?

 

Also, the email which contained the link could possibly get forwarded on to someone who needs to see some of the discussion in the email itself but not the actual document. I'm sure we've all been forwarded the 20th email in a long thread and therefore been able to see emails 1-19 which weren't relevant and might not even be appropriate to be shared. Human error, but it happens.

Edited February 9, 2018 by enjay

[Ditto]

There is a setting "Anyone at can find and access", so I believe a link could be found that way, but I would have though that already means they have access. It can get even harder to track when a document moves folder and there are shares to groups. I've recently reiterated to all staff to only use link sharing "Off - specific people" for anything with sensitive data, and then to only add known individuals. With some unexpected results in the 'Shared with me', which Google support are looking at, I remain nervous. You're right about the forwarding of emails - it could bring to someones attention a document which wasn't planned. Even more of a concern is where the document has gone to an individuals onlien email account (not necessarily a school gmail account), and following clicking on it, it's been accessed by a separate school account because it's a shared device and the previous user had used 'remember password' and not logged off. We're still looking at how to defend against that.

[enjay]

it's been accessed by a separate school account because it's a shared device and the previous user had used 'remember password' and not logged off. We're still looking at how to defend against that.

 

We advise staff members who have children in the school / children who know children in the school not to use "save password". We should probably advise that of all staff, but that would trigger an increase in written-down passwords, so from a risk mitigation viewpoint, I'm unsure which is the better (least bad?) way to go.