The New Hidden Risk of Unrestricted Sharing in Google Workspace

Google Workspace has revolutionized the way organizations collaborate and share information with tools like Google Docs and Google Drive. However, there's a new hidden danger lurking within the seemingly innocuous "Anyone with the link" & “Sharing with domain” options that many users may not be aware of.

What are the Sharing Options in Google Workspace?

Best practice is to only share your files with users that absolutely need access to the data. Luckily, Google Workspace makes this easy, for example with Shared Drives, Dynamic Groups and Organizational Units.

Google Workspace allows you to share files with these options:

Restricted: Only people explicitly granted access can open the link.
With a Group or Domain: Anyone in this group with the link can view.
Anyone with the link: Anyone on the internet with the link can view.

Sometimes the latter two options are used because they’re perceived as easier for sharing folders or files with many people, without the need to type in their names or arrange smart sharing solutions.

The “Anyone (..) with the Link” Illusion

The common misconception is that only individuals who directly receive the link can access a file shared this way, whether it’s shared within your domain or the whole internet. While it’s true that the file won’t show up in a general (Google) search, the reality is more nuanced. The phrase “Anyone in this group/domain with the link” or “Anyone with the link” implies a degree of privacy that doesn’t fully exist.

Gemini AI may access¹ files that are shared with the “Anyone (..) with the Link” permissions. While these files are not shared outside of your organization (in the case of “Sharing with domain”), it might be a risk because the people who used these sharing options, didn’t intend domain wide access. For example somebody who shared a Google Sheet with salary information and chatted the link to their team.

Note 1: It’s good to mention that Gemini falls under the Google Workspace terms, and data in your organization is never shared outside of the organization, and won’t be used to train Google AI.

Mitigating the Risks

You can train employees on file sharing best practices and the potential risks associated with “Anyone with the link” sharing. Raising awareness about security risks can help prevent accidental data exposure and encourage responsible file sharing practices. People often use the “Anyone with the Link” option because it’s easy, but they’re unaware about the security risks.

The best solution is to gain insights into sharing behavior (especially the “… with the link” options). Florbs is a tool specializing in this, and even more interestingly, it lets you change the sharing permissions in bulk.

Florbs: A Solution for Bulk Permission Management

Florbs offers a user-friendly interface and powerful features for managing file sharing permissions in Google Workspace. Here’s how it can help:

Audit File Access Permissions: Florbs allows you to audit file access permissions across your Google Drive, identifying which files are shared with whom and what level of access they have. This helps you gain a comprehensive overview of your file sharing landscape.
Revoke or Change Permissions: You can instantly revoke or change access permissions for individual users, groups, or entire domains. This gives you granular control over who can access your files.
Automated Workflows: Create security workflows to automatically revoke access or adjust permissions based on predefined rules. This automates security tasks and helps ensure consistent enforcement of your file sharing policies.

Conclusion

Google Workspace provides powerful tools for collaboration and file sharing, but it’s essential to be mindful of the security and privacy implications of your sharing settings. Take action now to review your file sharing permissions, implement appropriate access controls, and educate your employees on secure file-sharing practices. By prioritizing data security, you can ensure the confidentiality, integrity, and availability of your valuable information.