Cloud storage permissions degrade through ordinary use. Someone shares a folder to unblock a contractor, a link gets forwarded, a project ends and nobody revisits access. Nothing here involves an attacker — the exposure is created internally and simply never reviewed.

Both major platforms let you report on files shared as "anyone with the link". Run it. Organisations of every size find documents in this state that should not be: financial models, customer lists, credentials in spreadsheets, draft contracts. These are indexed by anyone who obtains the URL and require no authentication at all.

Then external collaborators

List every external address with access to anything, and check each against a current list of active relationships. Former contractors, ex-employees using personal addresses, and agencies from finished projects appear routinely. Removal is fast once you have the list; the list is the work.

Change the defaults

  • Default new links to internal-only, requiring a deliberate action to share externally.
  • Require expiry dates on external shares, typically 30 to 90 days.
  • Restrict who can share externally at all, where your platform supports it.
  • Disable download for sensitive shared documents where viewing suffices.

Watch the structural risks

Inherited permissions on nested folders surprise people: sharing a parent folder grants everything beneath it, including items added later. Shared drives owned by an individual disappear or lock when that person leaves. Both are worth checking explicitly rather than assuming.

Make it a scheduled task

This is not a one-off project, because drift resumes the day after you finish. A quarterly review, assigned to a named person with a written checklist, keeps it manageable. The first audit is always the longest; subsequent ones take under an hour.