Cloud security is not complete with the provider protecting the infrastructure. Account security, file permissions, sharing settings, and some backup decisions are managed by the user or institution. The limit of liability varies by service; It is necessary to examine the model and contract of the product used.
What does shared responsibility mean?
With a file sharing service, you don't manage the physical data center; but mostly you decide whether to turn on the “anyone with a connection” option. Protecting the infrastructure does not automatically fix file access granted to the wrong person. This is why the organization's data classification and account lifecycle are important.
Collapse sharing links
If the file is for specific people only, share to authenticated recipients. If no editing is required, grant viewing permissions. If expiration and download limitation are supported, use accordingly; Note that these settings will not completely prevent copying via screenshots or other means.
For example, when sending a proposal file to an external consultant, separate the necessary file instead of sharing the entire team folder. Determine the person responsible and the date to close access when the project is completed. The “sent once, then forgotten” approach can lead to access accumulation.
Basic controls for cloud account
- Use appropriate MFA on important and administrative accounts.
- Separate daily work and management accounts whenever possible.
- Plan for access and ownership transfer upon user departures.
- Review connected third-party apps and their permissions.
- List public connections periodically and close unnecessary ones.
- Monitor logs of suspicious login and sharing activity.
Try backup and deletion scenarios
Just because a file is in the cloud doesn't mean you can go back to any date you want. Learn the retention period of deleted data, version history, and what happens if the account is closed. Critical files may require an independent backup plan. The requirement should be determined according to the importance of the data and the capabilities of the service.
For testing, try controlled deletion and retrieval with a non-sensitive document. Record which user role can restore, processing time, and limits. This way, you are not relying on a vague “provider is present” assumption at the time of the incident.
Quick check before sharing
- Does the document contain unnecessary personal or corporate information?
- Is the identity of the recipient correct and to which account is the post shared?
- Viewing or editing required?
- When will access end and who will turn it off?
- How will ownership be transferred if the owner of the file leaves?
Frequently asked questions
Is it enough to put a password on the connection?
It is not enough alone. Risks such as sharing the password, spreading the connection, and forgetting the access time remain. If possible, limit it to the recipient ID.
Does the cloud provider handle all security settings for me?
No. You should also verify which side the user, application and data settings are on for the service you are using.
Related contents: backup plan and cloud security basics.
Source and further reading
CISA: Cloud Security Technical Reference Architecture. Source check date: 17 October 2026.
