How SMBs Can Enhance OneDrive Security

Although it is not as popular as Google Workspace among SMBs, Microsoft 365 is a powerful collaboration tool. In this article, we discuss how to enhance OneDrive security.

OneDrive Security Challenges

OneDrive is generally a very secure tool. The data is kept in remote data centers that are well-protected from physical incidents and cyber threats like malware. However, there are several security gaps that can cost businesses dearly if their IT teams do not make the necessary changes.

Data Loss

Several factors can cause data loss in OneDrive:

• Human error (for example, accidental file deletion, editing, or overwriting).
• Cloud ransomware encrypting files in OneDrive.
• Man-in-the-middle attack.
• The malfunction or vulnerability exploits in the OAuth applications with editing permissions.
• Lack of DLP policies.

Data Leak

Data leak occurs in OneDrive due to the following factors:

• Improper sharing settings.
• Account hijacking.
• Zero-day attacks.
• Social engineering attacks.

How to protect OneDrive data

Data Retention Policies

Use a data retention policy for your business’s most critical and sensitive data. This policy will make a copy of the protected file when it’s edited or deleted. Later on, your Admins can recover this file from a special repository.

We suggest against using data retention policies for all OneDrive data. The problem with Office 365 is that it creates a copy of a document protected by this policy every time somebody edits it. The copy is stored in the same storage. 

The main concern here is storage space rather than data loss (it’s impossible to reach retained files for users other than Office 365 Admins). The retention policy can gradually take up all your storage space if you protect all the files you have.

Learn more about Microsoft 365 data retention and How to transfer OneDrive files to another account.

Data Backup

At the beginning of the cloud adoption process, many companies associated SaaS collaboration office suites like Google Workspace and Microsoft 365 with backups. Many regretted such a perception.

OneDrive is not a backup for your data because it is vulnerable to many cyber incidents (see previous section). We suggest using third-party cloud-to-cloud solutions that can make daily scheduled automated snapshots of your OneDrive (and other Microsoft 365 services, e.g., Exchange).

The backup tool will guarantee the intactness of your data in a separate data center. Unlike OneDrive files that are open for many people to edit, the snapshots cannot be modified or deleted.

Learn more about OneDrive backup.

Ransomware protection

Ransomware protection is a must-have tool in the modern world. This type of malware is one of the few that can actually harm OneDrive data. Built as a regular SaaS application with editing permission and disguised as a legitimate tool, cloud ransomware can encrypt your entire data in a couple of hours.

Meanwhile, restoring data from a backup in case of such an event might take a while and cause unnecessary downtime.

We suggest acquiring behavior-based AI ransomware detection for OneDrive that proactively stops ransomware attacks at the very beginning.

Learn more about Microsoft 365 ransomware protection.

Data archiving

Data archiving is a way to secure OneDrive data that is not used anymore but must be retained for various reasons (e.g., compliance, business needs, etc.). Data archives are cheaper. They do not have collaboration capabilities. Think of them as data repositories, where data stays intact for a long period of time.

You can use Office 365 or third-party vendors for data archiving.

Learn more about data archiving.

Sharing policies

Limiting file-sharing capabilities for users can help prevent data leaks. Some employees like to set sharing configurations to anyone with a link. As a result, unauthorized people within and outside organizations can get access to your most critical and sensitive files.

There have been several incidents like this with devastating outcomes.

We also suggest using tools that give visibility into data sharing and access. It can help you avoid serious security incident.

Application Control

To ensure OneDrive security, businesses should monitor which applications have OAuth access to their Microsoft 365. Detecting and evaluating risky applications can help them prevent zero-day attacks, when cybercriminals exploit app vulnerability and strike companies that use it.