A client needs a secure solution for sharing files and/or for storing them in the cloud
Edit me

Recommendations on Secure File Sharing and File Storage

Secure solutions for sharing files and for storing them in the cloud

Problem

The client is sharing sensitive files with their colleagues and partners through insecure platforms that are neither end-to-end encrypted nor trusted.

The client is looking for a secure way of sharing or storing sensitive files.

The client might need to anonymize their connection when sharing a file.

Solution

Questionnaire

In order to identify the best file sharing and file storage solutions for our client, we need to assess their needs and context, by answering the following questions:

Explore context and threats
  • What are your main activities?
  • What is your mission?
  • In which country are you based?
  • What is your main concern? For example, you might be worried about your adversary accessing sensitive data, or about your personal identity being linked to specific data.
  • What kind of sensitive data do you handle and what could happen if there was a data breach?
  • What would happen if your identity was connected to the shared files?
  • Have you or some of your partners been attacked before? Which kind of attack?
Assess client’s needs
  • Do you need to store files permanently or to share files with others just once?
  • Do you have your own server?
  • Can you manage a server or do you have an IT person who could manage it for you?
  • Do you have funds to rent a server/VPS (Virtual Private Server)?
  • Do you already use a storage service? Which one?
  • What service do you currently use to send large files?
  • Do you need to share files with your team or also with people outside of your team?
  • Do you need the service to be integrated with other features, like collaborative writing, calendar, etc.? Which features?
  • What would you use the additional features for?
  • Do you need access privileges for different kinds of files?
  • Do you need to organize or sort the documents, for example by tagging them?
  • Which devices are you going to use to access the files? PCs/laptops or mobile devices? Which operating systems?

Recommendations

Once we have assessed the client’s needs and risks, we can suggest the best options. We should always recommend more than one option, so that the client can decide what’s the best for them.

We should also take into account the client’s current workflow: if the client is already using a commercial service, moving to another file storage solution might disrupt their workflow, especially if they’re using a full package of applications like G Suite. In such cases we should explore with them what their (and their organization’s) capacities are, and if they would rather stick to their current workflow or if they are willing to switch to a different solution. To help them make this decision, we should also consider if they have any adversaries that might have legal access to their commercial accounts.

If they don’t have the capacities to change their workflow, we could work on securing their workflow, for example by suggesting they encrypt sensitive files with Veracrypt before they upload them to the cloud storage they are currently using, or by recommending that only people handling sensitive data use an alternative file sharing or storage service.

If the client is using a commercial service, like G Suite or Dropbox, we should instruct the client to check the security and sharing settings, and to enable multi-factor authentication wherever possible.

  • GDrive - See Article #146: Secure File Sharing on Google Drive.

  • Dropbox

    • Dropbox instructions on how to secure an account
    • Dropbox instructions on how to set up 2-Step Verification
    • More recommendations for Dropbox:
      • Only add Dropbox to devices where you need access to work documents - each new device used with Dropbox is a new device you will need to protect.
    • Become familiar with the security settings and make adjustments accordingly, for instance:
      • Keep an eye on what extension apps you have allowed to view your Dropbox data. Remove apps that are no longer in use.
      • Receive notifications for when a new device has accessed the Dropbox account or a new app is added under the profile page.
      • Be aware that Dropbox protects your data in transit to Dropbox servers and to those you share it with, but it does not protect the data itself if someone were to enter your account or your recipients’ accounts, or otherwise access the documents.

If the client is willing and ready to switch to a different platform, we should base our recommendations on the client’s needs and on the following criteria:

  • Usability of the service
  • Accessible end-user documentation
  • Friendliness towards NGOs
  • Customer service and responsiveness
  • Costs
  • Included services for groups, like a calendar or collaborative editing features
  • Country where the company is based
  • Security features (end-to-end encryption, HTTPS/TLS, 2-factor authentication…)
  • Free and open source software both client- and server-side

What follows is a list of services that match with some or all of these criteria. This list is by no means complete, but it includes a selection of cloud storage and file sharing solutions that offer good security features and are managed by trusted entities and/or located in safer jurisdictions.

Commercial
Packages
File storage only
  • Sync.com
    • Paid service
    • End-to-end encrypted
    • Privacy Whitepaper
    • 2-Factor authentication
    • Multiplatform sync
    • Sharing, collaboration, and file transfer
    • Granular user permissions
    • Global data privacy compliance
    • Proprietary
    • Based in Canada
  • Resilio Sync (formerly BitTorrent Sync)
    • Commercial, paid app
    • Multiplatform peer-to-peer app
    • Not cloud-based - needs at least 5 more nodes to run
    • End-to-end encryption - Resilio Sync encrypts data with an Advanced Encryption Standard AES-128 key in counter mode which may either be randomly generated or set by the user. This key is derived from a “secret” which can be shared with other users to share data.
    • Proprietary
  • TeamDrive
    • Paid service
    • End-to-end encrypted
    • Multiplatform sync
    • Granular user permissions
    • Automatic backup and version control
    • GDPR-compliant
    • Proprietary
    • Based in Germany
Free
Tools for groups

What follows is a list of software for groups, including file storage and sharing, that can be self-hosted. If the client wants to self-host one of these solutions and needs guidance in choosing a hosting provider, refer to Article #88: Advice on Hosting.

  • Nextcloud - Nextcloud is a suite of client-server software for creating and using file hosting services.
  • Sandstorm - Sandstorm is an open source platform for self-hosting web apps
  • Crabgrass - Crabgrass is a web application designed for activist groups to be better able to collaborate online.
    • Can be self-hosted - Installation instructions
    • Hosted by Riseup on we.riseup.net - it doesn’t need a Riseup mail account, but an account needs to be created
    • Not very intuitive
    • Includes tools like file sharing, image gallery, video player, forum, public and private wiki, task manager, surveys, and polls
    • Groups and subgroups can be created
    • Free and open source
File storage only

For secure file storage on any non-encrypted cloud service the client might be using, we can recommend that they encrypt files or folders with Veracrypt before they upload them to the cloud, and then share the Veracrypt database channel with colleagues and partners through a separate encrypted channel.

Another solution is to use Cryptomator and sync it with the client’s current platform. Cryptomator is a free and open source multiplatform app that provides transparent, client-side encryption for cloud storage. To share a vault with others, the client will need to share the vault password through an encrypted channel.

File transfer
  • share.riseup.net
    • Hosted by Riseup
    • Client-side encryption
    • Free and open source (Up1)
    • Upload is currently limited to 50mb and files are stored no longer than a week
    • Does not require an add-on, and can be used in any modern browser
Anonymous file transfer
  • Onionshare - OnionShare is an open source tool that lets you securely and anonymously share a file of any size.
    • App for Linux, Mac, and Windows
    • Localized in 12 languages
    • Tor Browser needs to be installed on the system to download the shared file
    • Free and open source
    • OnionShare has an advanced option, “Create Stealth Onion Service”, that makes it impossible for an attacker to connect to the onion address created by OnionShare even if they learn the onion address. For more information see this guide.
    • OnionShare creates next generation onion services by default.
    • Sharing can be limited to one download or extended to the public, and a persistent onion service address can be generated.
    • The “Receive mode” turns a computer into an anonymous dropbox: it generates an onion service address where people can upload files using the Tor Browser.
    • MacOS Sandbox - The macOS sandbox is turned on in OnionShare 2, which means that even if someone manages to exploit a vulnerability in OnionShare to try to hack a computer, they still won’t be able to access data or run programs on that computer without first escaping the sandbox.
    • *

Comments

Tags: devices_data_security articles