The Shared Drive That Leaked to the Whole Domain
A marketing team of 30 stores campaign assets in a Shared Drive called 'Campaigns.' The Shared Drive is shared with the entire organization (all 240 users) as a member with 'Contributor' access because 'everyone might need to grab a logo.' Inside, a subfolder 'Embargoed-Launches' holds unreleased product materials. Last week a sales rep opened an embargoed deck and forwarded it externally. Leadership wants the leak stopped without breaking the 30 marketers' daily work, and without a week-long permissions audit. You also learn that external agencies occasionally need to drop files into a 'Vendor-Drop' folder.
1. Diagnose why the current sharing model caused the leak, and propose a permissions redesign that keeps marketers working while closing the exposure.
Read the worked answer
Root cause: Sharing the Shared Drive with the whole organization as Contributor means every one of the 240 users has broad access to everything inside, including the embargoed subfolder. There is no tiering - the 'grab a logo' convenience granted write-level access to sensitive material. Contributor also lets people add/move content, widening the blast radius.
Redesign:
- Remove the org-wide Contributor membership. That single broad grant is the exposure.
- Grant marketers access via a Google Group (e.g.,
campaigns-team@) as the Shared Drive member with the access they actually need (Content Manager or Contributor). Manage membership by group, not per-person - this scales and makes audits trivial. - Tier the sensitive content: move 'Embargoed-Launches' to its own Shared Drive (or a folder with restricted membership) accessible only to the people who need it, not the whole marketing team. Use a small group for that.
- Give the rest of the org read-only, scoped access only to the specific public-asset folder (e.g., a 'Brand-Library' folder shared as Viewer with the org), not the whole drive.
- Vendor-Drop: create a dedicated folder where external agencies are added as members with the minimum role needed to upload. Consider a separate Shared Drive for vendors so their access can't reach internal content.
This keeps the 30 marketers working (via their group) while removing the 240-person broad grant and isolating embargoed material.
2. The sales rep who forwarded the deck externally did so from a file they legitimately opened. Explain what access controls and sharing restrictions you'd apply to reduce this class of incident, distinguishing controls that prevent sharing from controls that detect it.
Read the worked answer
Prevent (block the action):
- Sharing settings on the sensitive Shared Drive: restrict who can share and to what audience. Set the drive so members cannot share externally, or limit external sharing to a domain allowlist. This stops a user from forwarding/sharing embargoed content out.
- Disable 'anyone with the link' and external sharing on the sensitive location. Default to internal-only for embargoed material.
- Least privilege: the rep shouldn't have had access to the embargoed folder at all - the tiering from the prior task is the primary preventive control.
- Information Rights Management / download restrictions on the most sensitive files where supported, to limit copy/print/download.
Detect (catch it when prevention fails):
- Drive sharing alerts / activity rules: alert when a file in the sensitive drive is shared externally or a link is changed to public.
- Audit log review for external-sharing events and downloads of embargoed content.
- DLP rules to flag content matching embargoed-material patterns leaving the domain.
Key distinction: prevention (sharing restrictions, least privilege) stops the action before it happens; detection (alerts, audit, DLP) tells you after the fact. You need both, but the rep's legitimate access means prevention via tiering is the highest-leverage fix - if they can't open it, they can't forward it.
3. Leadership asks how you'll verify the fix worked and prevent drift. What would you check, and how do you keep the 'everyone gets access' habit from returning?
Read the worked answer
Verification:
- Enumerate current members of the Campaigns Shared Drive and confirm the org-wide membership is gone and only the intended group(s) remain.
- Test as a non-marketer: confirm a typical employee can reach only the brand-library folder, not embargoed content.
- Test external sharing on the sensitive drive: confirm it's blocked.
- Review audit logs for any remaining external shares or broad-link creations after the change.
Prevent drift:
- Group-based membership only - no direct user grants on the drive. Adding/removing people happens in the group, which is reviewable.
- Periodic access review of Shared Drive membership (quarterly), owned by the marketing lead.
- Default-deny posture: new Shared Drives should not be org-wide by default; require an explicit decision to grant broad access.
- Alerting on new org-wide or external shares of sensitive drives so a regression surfaces immediately rather than at the next audit.
- Document the model so the next person doesn't re-create the convenience grant.
The habit returns when broad sharing is the path of least resistance - so make the group the easy path and put an alert on the risky one.