Don't Let the Hackers Get onto your Files, either Personal or Professional.
Tags: security, organisation, discuss
Published: 2020-03-17 16:47:30

---
title: Don't Let the Hackers Get onto your Files, either Personal or Professional.
published: true
description: How to manage sharing files and information within an organisation and do it securely. 
cover_image: https://images.unsplash.com/photo-1520387294843-fd994fd872e7?ixlib=rb-1.2.1&ixid=eyJhcHBfaWQiOjEyMDd9&auto=format&fit=crop&w=1275&q=80
tags: Security, Organisation, Discuss
---

*Photo by [Fahrul Azmi](https://unsplash.com/@fahrulazmi) on [Unsplash](https://unsplash.com/s/photos/library)*

> How do you handle all the documents in your company ? Is everything available to everyone at any time? Is there some restrictions on some documents ? Did you ever (or someone) think about it ?

### Introduction

🤔 For example, how do you manage your application's architecture documents and how to share these documents within your organisation ?

💻 Often, we have these type of files on a hard drive on your computer. 
<figure>
  <img src="https://images.unsplash.com/photo-1531492746076-161ca9bcad58" alt="Hard Drives" style="width:50%">
  <figcaption>Photo by Vincent Botta on Unsplash</figcaption>
</figure>
---

💥 But what happens if your computer explodes (that is pretty rare, but you got the point) ?
<figure>
  <img src="https://images.unsplash.com/photo-1511909938134-66234e1aa5c9" alt="Hard Drives" style="width:50%">
  <figcaption>Photo by Caitlin Wynne on Unsplash</figcaption>
</figure>
---

💾 So, I am saving these files on an external harddrive (both are not going to explode at the same time. Are they ? 🤔).
<figure>
  <img src="https://images.unsplash.com/photo-1551818014-7c8ace9c1b5c" alt="USB Keys" style="width:50%">
  <figcaption>Photo by Sara Kurfeß on Unsplash</figcaption>
</figure> 
---

😤 My datas are now on a USB key, which can be stolen or lost pretty easily (just as my computer), and so someone ill-intentioned can get it.
<figure>
  <img src="https://images.unsplash.com/photo-1531308426888-c82938fe3281" alt="USB Keys" style="width:50%">
  <figcaption>Photo by Markus Spiske on Unsplash</figcaption>
</figure>
---

☁️ An easy solution would be to put all of my datas to the cloud 
<figure>
  <img src="https://images.unsplash.com/photo-1499346030926-9a72daac6c63" alt="Cloud Computing" style="width:50%">
  <figcaption>Photo by Pero Kalimero on Unsplash</figcaption>
</figure>
---

👎🏼 Is it really a bad idea to put all your sensitive (even critical) datas on Public cloud whose I don't have any idea who has access to my files (the cloud provider employees are very likely to access it or the US government as well if it is on the  US soil 🇺🇸 🤔). It is a matter of trust (and data sovereignty 👑).
<figure>
  <img src="https://images.unsplash.com/photo-1504384308090-c894fdcc538d" alt="USB Keys" style="width:50%">
  <figcaption>Photo by Alex Kotliarskyi on Unsplash</figcaption>
</figure>
---

㊙️ You can then encrypt your data, was it on the external drive (the USB key for instance), or on the cloud service.
There are a lot of excellent products that are doing that.

Personnaly, I love Cryptomator , which works on any platform (Windows, Mac OS and **Linux**) and allows you to encrypt your data for any cloud service.
![Cryptomator](https://cryptomator.org/img/stage/logo@2x.png)
![Cryptomator list](https://cryptomator.org/img/screenshots/app1@2x.png)

---

🤝 Often (all the time 🤔) in organisations, we are interacting in groups. And working in groups means sharing files. If one don't really care if the cat picture you shared on the network leaks, I do think that it would be critical if technical architecture files or Audit files leak.

---

### Sharing Files within an Organisation

📧 To share files, one usually uses e-mail.

#### 1. Classify the Files

In order to take the proper decision in terms of sharing a file, you have to have classified such files regarding their confidentiality level.

The classification I am using is pretty classic.
Files have 4 privacy types :
* **Restricted** (only some clearly identified people can access the file)
* **Confidential** (only a subset of people within the organisation can access the file)
* **Internal** (it is available to people within the organisation)
* **Public** (it is available to anyone. It is a press release for instance)

In case of **Restricted** or **Confidential** files, you must encrypt your e-mails.
In case of **Internal** files, file's encryption has to be considered on a file to file basis.
The **Public** files do not need to be encrypted (but you can encrypt everything as it is set up. 😉 So this way there is no risk of leakage before you decide to release the file).

---

#### 2. Encrypt the Communication

A lot of organisation are using Microsoft Exchange as their e-mail servers. Using Outlook, it is easy as pie to encrypt a file.
<figure>
  <img src="https://dev-to-uploads.s3.amazonaws.com/i/9n11nfwh9f6xnlsx47j5.png" alt="Encrypt your e-mail" style="width:50%">
  <figcaption>Encrypt your e-mails on Outlook</figcaption>
</figure>

Nevertheless, you have to understand that when you encrypt an e-mail, you just encrypt the content of it and not the attached files nor the subject (just as https does not encrypt the URL, and so that "id" you added at the end of it 😉) .
Similarly, encrypting an e-mail does not guarantee that these e-mail or its attached file cannot be transferred to someone else unsecurely.
And if you do not control to whom you sent the file means that you have no possibility to know who is responsible for a leak.

{% youtube jHYswVss2Ok %}

Finally, once you've done all that, one can think that all the documents we have and share are safe and cannot fall in the wrong hands.
But as soon as I am sending a file, I am giving control over it.  🙅
But as I am responsible for the security of the file I shared, I have to keep control over it. Let's see some technics that I am using to keep control over the files I am sharing.

The first one is very simple. In your e-mail client (Outlook, Postbox, Thunderbird, etc...), one must select, in addition to "Encrypt", the "Do Not Transfer" option. That way, the recipient can only read the file through its e-mail client and nothing else.
<figure>
  <img src="https://dev-to-uploads.s3.amazonaws.com/i/ft1odiwxzsdenqzmp4gh.png" alt="Encrypt your e-mail and Dot Allow Transfer" style="width:50%">
  <figcaption>Encrypt your e-mail and Dot Allow Transfer on Outlook</figcaption>
</figure>

---

#### 3. Empower the Recipient

Here is a method that is used by Movie Studios when they are sending movie rushes and avoid leaks (let's have a look at [X-Men Origins in 2009](https://www.theguardian.com/world/2009/apr/02/wolverine-xmen-leak-online-piracy)). I am using something similar to empower my recipients.
It consist of watermarking the file with the recipient's name. It allows, if the file leaks, to know what copy of the file leaked and take actions regarding this piece of information.

I made a tool on Github to automate watermarking pdf files.

{% github Shosta/MassWatermark %} 

---

#### 4. File Management Tools
 
All of these methods are very useful but cannot replace a proper **Document Management System**. 

It is important to have a software which can store files regarding their classification, was it "Restricted", "Confidential", "Internal" or "Public".
This allows a very strict file management, but also a collaborative work.

Sharepoint, from Microsoft, allows this. It is part of the Office 365 service. But a lot of other tools providing this exact service are available on the market. [Confluence](https://www.atlassian.com/fr/software/confluence), from [Atlassian](https://www.atlassian.com/fr), allows a very strict access right management and can be a very good answer to this problem.
<figure>
  <img src="https://dev-to-uploads.s3.amazonaws.com/i/mviazbgn2yvv1n75mivh.png" alt="Hard Drives" style="width:50%">
  <figcaption>Sharepoint from Microsoft</figcaption>
</figure>


---

*I hope you enjoyed that article and learned a lot of things about proper file management and file sharing within an organisation.*

*It is also good practice to think about that for your own files.
I do not upload files (either "critical" or not) on someone else's computer (aka "The Cloud") unencrypted. [Cryptomator](https://cryptomator.org/) is my software of choice for that.
And in terms of Cloud, I made [my own](https://syncthing.net/) for 100€.
You want your own as well. Read [my article on how to build it](https://dev.to/shosta/do-you-care-about-your-privacy-maybe-it-is-time-to-set-up-your-own-dropbox-ncf) for less than 100€ and you got 3To (at least) for ever (that's a pretty decent deal, I guess 😉).*