.png)
“Anyone with a link” or public sharing - these are Google Drive assets accessible to everyone in the world compared to external sharing that is limited to specific individual(s).
A recent alarming issue, highlighted by HackerOne, revealed that the U.S. Department of Defense accidentally publicly exposed a critical order within Google Drive, disclosing sensitive personally identifiable information (PII) and operational data, such as:
- Name
- Social Security Number
- Marital Status
- Security Clearance Level
This is highly sensitive information that not only exposes private military details but also puts both the individuals and their families at significant risk. Imagine the potential consequences if foreign adversaries gained access to this data, knowing details about our personnel, their families, and their roles within the Department of Defense.
As soon as this was reported, the DoD took swift action to mitigate the risk. However, this raises important questions: How did this happen? What else might be out there? Who has already accessed this file, and what data has been taken?
What is the risk?
Gone are the days of sending files via FTP or email and waiting endlessly for feedback. Today, everything is done through cloud file-sharing platforms, enabling faster communication and instant feedback.
The issue, however, is that many organizations lack the proper controls to monitor and manage the risky sharing of this data. At DoControl, we offer a free risk assessment for Google Workspace customers. When we integrate, we typically find that over 5,000 sensitive assets are publicly exposed - and these are just the public-facing ones. It doesn't include external documents, such as assets shared with former employees, personal Gmail accounts, former contractors, and more! These assets often include proprietary information such as financial data, product code, product roadmaps, customer details, employee records, and, in the worst-case scenario, sensitive military information.
How does this happen?
You might be wondering, "I understand the risk, but how is this happening in my organization?"
- Human Error: Often, users aren't aware of the actions they’re taking, which can lead to accidental exposure of sensitive data.
- Multi-Platform Sharing: When trying to share a file with someone using a platform other than Google Drive - such as Box, Dropbox, or SharePoint - users find it difficult to share directly. As a result, they often set the file to public, allowing anyone with the link to access it.
- Improper Controls and Settings: Many organizations don’t have their Google Workspace properly configured, and lack the security tools needed to monitor and remediate the exposure of sensitive assets within their environment.
How does DoControl control Public Exposure within Google Drive?
If you’ve made it this far, you're probably asking yourself, How could the DoD have avoided this? What’s exposed in my organization? How do I fix it, and how can I prevent this in the future? That’s exactly why DoControl exists: to provide an all-in-one Google Workspace security solution that covers Data Access Governance, Shadow Apps, ITDR, Misconfigurations, and more - ensuring that scenarios like this never happen again.
Uncover Exposure
DoControl is an API-driven, event-based SaaS data security solution that can instantly identify not only public assets but also external shares - such as those made with former employees, top exposed domains, and much more. Our platform provides you a clear, comprehensive view of who has access to your data.
Quantify Your Risk
Once you understand the exposure, it’s critical to assess the risk it poses to your data. DoControl helps you do this in several ways. First, we integrate with your HRIS and IdP tools to link user data with SaaS activity. For instance, we can identify if a former employee is still accessing data through their personal Gmail account. Second, we help classify your data, highlighting which assets contain sensitive or risky information.
Remediate Historical Exposure
After identifying both exposure and risk, the next step is to remediate the assets that are vulnerable. DoControl’s unique bulk remediation feature allows you to quickly revoke access to up to 1 million assets with a single click, effortlessly eliminating risky data exposure.
Control Future Exposure
Even after remediating past exposure, it’s essential to prevent future risks. DoControl’s API-driven, event-based workflows enable you to create granular policies that control data exposure in real-time as risks emerge. This ensures that you’re proactively protecting your data going forward.
FREE Google Workspace Risk Assessment
The first step in securing your Google Workspace is to assess and understand your risks. That's why we offer a free Google Workspace risk assessment that provides the insights you need to identify existing risks and determine the actions required to mitigate them.
If you are interested, feel free to reach out to our team - click here.
.png)
