Six tips for building an enterprise-ready security strategy for file sharing

There’s been an unprecedented effort to put economic growth and enterprise productivity back on track, after the disruption caused by the pandemic. Just as in other times of crisis, companies were forced to learn from their experiences and rethink the foundations of their operations. Online security has proven to be one of the building blocks for the uninterrupted running of business in the new remote work setting. Moreover, secure file transfer has also come to the fore in enterprise strategy as a key enabler of any kind of business transaction and communication.

Just to name a few facts from our Secure File Transfer Report on how IT decision makers evaluate the security of their communication channels and where they see need for urgent improvement:

• 72% of respondents say that external file sharing has gained in importance since the start of the pandemic
• enterprises are struggling to make the switch to end-to-end encryption, with only 30% of the big companies (+1500 employees) surveyed using fully encrypted services
• only 38% of organizations have company policies for file sharing in place

To help you conceive a future-proof strategy for internal/external file sharing and pave the way for worry-free business collaboration with teams and external partners, read our guide below. With special focus on post-pandemic trends, the following tips can help you drive growth and satisfy the demands for changing work styles.

1. Adding end-to-end encryption as an additional security layer

Cloud computing may have enabled enterprises to quickly scale, expand and react to their technical business needs, but a switch to the cloud requires that data security becomes part of a business’s strategic agenda.

Whilst most cloud services offer a reasonable level of data security (and, thanks to bundled services, ease of use and unified comms), nearly all enterprises can benefit from an additional layer of end-to-end encryption. Since all companies handle sensitive company and personal data, E2EE can help them firm up their IT security infrastructure, mitigate the damage caused by employee mistakes and allow for peace of mind when transferring documents and files of all shapes and sizes.

Couple this with the context of a global pandemic and a sudden shift to remote ways of working, and it’s clear that end-to-end encryption (E2EE) should be embedded as part of any enterprises data security strategy.

2. Mapping, classifying, and protecting your data assets

Enterprises produce high volumes of data, and these data assets are expanding daily at an exponential rate. Mapping, classifying and protecting digital valuables is therefore essential to building towards a robust data security strategy.

Shifting towards this approach starts with understanding the nature, current setup and dynamics of your data. This should also extend to mapping your unstructured data (such as emails, files, audio and video assets etc.), as these generally represent the largest portion of an enterprises data sources (and, by default, are the most volatile assets within any given organization).

Understanding where your sensitive data sits and how it’s created/managed/shared paves the way for your organization to create policies for data classification and handling. There are multiple benefits to this exercise: protocols for data classification provide a common scheme for defining the confidentiality of your data (public, internal only, confidential, restricted), which gives employees and external partners a clear guideline on how to handle, store and share information according to their sensitivity labels.

Choosing the right secure file transfer solution can facilitate these data protection efforts and allow for adoption of data classification best practices at scale and speed, thus helping you enforce security measures according to the sensitivity level of your data assets.

3. Establishing company policies for external sharing

Setting up filesharing policies for external sharing is an essential part of the data security strategy process, as sending files to any external party is inherently risky.

Once established, these policies need to incorporate a measurement mechanism that allows IT decision-makers to monitor sharing habits, device usage, data exchanges and any data leakage points. The insights from these measurement metrics can then be fed back into the policies which, with ongoing tweaking/iteration, will eventually create healthy data habits across all levels of your enterprise’s org structure.

4. Staying in control of your application landscape

One of the unwanted side effects of rapid digitization has been the rapid proliferation of digital tools, apps and platforms, which has provided the conditions of shadow IT to thrive – and a scenario all IT security professionals would ideally like to avoid.

Loss of transparency over applications can weaken your security and data protection. The more tools enterprises use for storing and transferring files, the more likely that security weaknesses and data leak points will slip into their systems, turning their application ecosystem into a fragmented infrastructure.

While the spread of new tools cannot be stopped, the procurement of cloud services should be governed by policies that put great emphasis on security. Using less tools and channeling sensitive communication into one secure tool can help you get back control over your data assets.

5. Securing external collaboration to prevent supply chain attacks

No enterprise operates in a vacuum – today’s large businesses exist as part of a highly connected value chain and have a strong dependence on their partners to scale.

This can create a false sense of security based on the assumed existence of watertight security measures. The reality of this set-up is different – the more data you share through your supply or value chain, the more exposed your sensitive data assets become.

Exploiting a weak link in the supply chain opens up novel opportunities for hackers. By slipping malicious code into a single supplier’s channel, an individual or rogue group can infiltrate an entire network of companies.

The devastating SolarWinds attack is an example of just how quickly things can snowball if a “backdoor” is set up by a rogue third-party service provider. In this case, more than half of SolarWinds’ client base was affected, with over 18,000 companies (including Fortune 500 companies and US government agencies) unwittingly installing a software update that contained malicious code.

6. Making vulnerability management an integral part of your security strategy

Threat management has become an important part of the IT departments data security strategy, and most enterprises mobilize huge resources to discover, report and close vulnerabilities.

However, the circulation and surveillance of vulnerability files – using vulnerability inventories, penetration test results, security reports and malware analysis – is an area that is often overlooked, and email attachments are (somewhat surprisingly) still a common method of sending and receiving sensitive files.

This represents a major gap in many enterprise data security programs, and one that is easily exploited by cybercriminals.

Learn more about Tresorit’s offering for reliable file sharing with teams and external parties here.