How to Use Cloud Storage Safely: A Day-to-Day Guide for Small Business
Most cloud storage problems in small businesses are not caused by the provider being hacked. They come from everyday habits: a folder shared with “anyone with the link”, a laptop that still syncs company files after it was lost, a former employee who can still log in, or a file deleted by mistake with no way back.
This guide covers how to use cloud storage safely day to day, whichever platform you use. If you are still deciding which service to use, start with our guide on how to choose the right cloud storage for your small business.
Understand who is responsible for what
Cloud providers such as Microsoft and Google look after their data centres, hardware and the service itself. You look after who can sign in, what they share, which devices hold copies of your files, and whether you can recover from mistakes. In practice, most of the risk sits on your side of that line, which is good news, because it means you can fix it.
Lock down sign-ins
Your cloud storage is only as safe as the accounts that open it.
- Turn on multi-factor authentication (MFA) for everyone, including the owner and any admin accounts. Our guide to implementing MFA walks through it.
- Give every person their own login. Shared accounts make it impossible to see who did what or to remove one person’s access.
- Use a password manager so each account has a long, unique passphrase.
- Keep admin rights to a minimum. Day-to-day work should not happen in an administrator account.
Share files the safe way
Sharing is where most accidental leaks happen. A few simple rules go a long way.
- Share with specific people, not “anyone with the link”. Public links can be forwarded and opened by anyone who finds them.
- Set an expiry date on links sent to clients and suppliers where your platform allows it.
- Give view-only access unless the person genuinely needs to edit.
- Share folders through Teams or shared drives rather than from one person’s personal storage, so access does not depend on a single employee.
- Review what is shared every few months and remove links that are no longer needed.
Most business plans let an administrator restrict external sharing for the whole organisation. If your team rarely needs public links, switch them off and allow exceptions only where needed.
Control the devices that sync your files
Sync is convenient because it puts copies of files on every laptop and phone. That also means a lost or stolen device can carry your company data with it.
- Encrypt laptops with BitLocker on Windows or FileVault on Mac.
- Require a PIN or biometric lock on phones and tablets.
- Make sure you can remotely wipe company data from a lost device.
- Decide whether personal devices may sync company files, and if so, under what rules.
- Keep operating systems and apps updated so known security holes are closed.
Plan for mistakes and ransomware
Cloud storage copies changes instantly, including bad ones. If someone deletes a folder, or ransomware encrypts files on a laptop, those changes can sync across the business within minutes.
Version history and the recycle bin help. In SharePoint and OneDrive, deleted items are kept for 93 days. But that is not the same as a backup you control. A separate backup service, tested regularly, means you can recover even if an account is compromised or something is not noticed for months. Our guide to simple backup and recovery plans explains what good looks like.
Handle staff changes properly
Starters and leavers are where access tends to drift.
- When someone joins, add them to the right groups rather than sharing folders with them one by one.
- When someone leaves, block their sign-in on their last day.
- Transfer ownership of files they stored in their own space before their account is removed.
- Check for links they shared externally and remove any that are no longer needed.
- Collect company devices and wipe any company data from personal devices.
Remember your privacy obligations
If your cloud storage holds personal information about clients or staff and your business is covered by the Privacy Act, a leak may need to be reported. Under the Notifiable Data Breaches scheme, covered organisations must assess a suspected breach and, where serious harm is likely, notify affected people and the OAIC. Storing less personal information, and deleting what you no longer need, reduces that risk.
Monthly cloud storage checklist
- Everyone has MFA switched on, with no exceptions.
- No unexpected “anyone with the link” shares on sensitive folders.
- No active accounts for people who have left.
- All laptops encrypted and phones locked.
- Backups ran successfully, and a test restore was done this quarter.
- Admin accounts reviewed and kept to a minimum.
Our managed IT security service includes 24/7 monitoring, so unusual activity in your cloud accounts is picked up early. And if you are reviewing your platform as well as your habits, see our guide to choosing the right cloud storage for your business.
Is your cloud storage set up safely?
Our free IT Health Check reviews your sharing settings, sign-in security, device controls and backups, and shows you exactly what to fix first.
Or call 1300 133 770.
