Office suites security: the review nobody schedules, and what it misses

Almost nothing that leaks out of a document store is stolen. It is shared, correctly, by somebody who meant to, with a setting that was wider than they realized or that stayed true long after the reason for it ended.

That reframes the whole subject. Encryption is not where your risk is. Your risk is in link permissions, in what is hiding inside the files themselves, and in what happens to a departing colleague's documents. All three are within your control and none of them appear in a security feature list.

What to take away

The four kinds of access, and how long each lasts

Every suite offers roughly the same set. They differ enormously in how long they remain true.

Named people. Access granted to specific accounts. The most durable and the most manageable, because it can be reviewed and it ends when the account does.

Anyone in the organization. Convenient, and quietly means every future employee too. Fine for material that is genuinely internal and public; wrong for anything sensitive, because the population it describes grows without anyone deciding.

Anyone with the link. The link is the credential. It can be forwarded, pasted into a chat, included in a message that is later forwarded to somebody else, and indexed if it ends up anywhere public. Treat every one of these as permanent unless you set an expiry.

Anyone, publicly listed. Rare and occasionally correct. Should be a deliberate act with a named owner.

Two settings make the difference between a manageable estate and an unmanageable one: whether links can be created with an expiry date, and whether an administrator can see every link that currently exists. If your suite offers the second, use it quarterly. Most organizations have never looked, and the first look is always instructive.

None of the four is unusual, and the reason they accumulate is that granting access is somebody's job and removing it is nobody's. The guidance on identity and access management is a short statement of the habit that prevents it.

The quarterly access review

Access accumulates in one direction. Nothing removes it on its own.

A workable review is short. Once a quarter, look at:

Assign it to one person, put it in a calendar, and keep the list of what you removed. The list is what turns the next review into ten minutes instead of an afternoon, and it fits alongside the joiner and leaver process rather than being a separate exercise.

What travels inside the file

The document you send contains more than what you see when you open it.

The standard advice: publish in a fixed format instead. That works only if the conversion flattens the content. Some conversions do. Some carry properties and hidden material through. Some carry an embedded copy of the original.

Test yours: make a fixed format file from a document you know contains hidden material, then inspect the result instead of assuming.

Better still, build the check into the process. Anything leaving the organization gets a deliberate final step: accept or reject changes, delete comments, unhide everything and look, and inspect properties.

Where the suite offers an inspection tool, run it, and where it offers a mode that strips this material on export, turn it on as described in your rollout defaults.

Document Inspector in Word, Excel, and PowerPoint sits under File, Info, Check for Issues. Adobe Acrobat has Sanitize Document and Remove Hidden Information for PDFs.

On export, Microsoft Purview sensitivity labels can encrypt a file and block editing, and the Drive Information Rights Management setting blocks download, print, and copy on eligible plans.

Sync, ransomware, and the restore path

Synchronizing storage is a replication system, not a backup. Anything that damages files on one machine is dutifully copied everywhere, and quickly. That is how these incidents usually unfold, and the plain account in ransomware guidance is a better specification for what to test than any feature list.

Version history is what actually protects you, but only if three things are true. The retention window must be long enough for you to notice within it, and someone must know how to restore.

Restore must also work in bulk, not file by file. Test all three before you need them on a folder of several hundred files, because a restore that works on one file but not a thousand does not work.

Typical defaults: Google Drive keeps a version for 30 days or 100 versions, whichever comes first, and a SharePoint library keeps 500 versions. Check the current default in your own tenant, and set the window to at least 90 days if a bad change can sit unnoticed for a week.

For the bulk test, use a folder of at least 500 files, the size where per-file restore stops being practical.

Two related settings deserve a decision, not a default.

Decide how much of the store syncs to each laptop. A machine holding a complete copy of the organization's documents is a different kind of loss when it goes missing. Decide who may remove large numbers of files at once. Bulk deletion is usually an accident and always looks the same as an attack for the first hour.

When somebody leaves

This is where document security is either designed or improvised.

If teams own documents rather than individuals, most of this problem never arises. That is the strongest argument for the arrangement and why it belongs in the fit assessment, not an afterthought.

The failure to avoid is deleting the account promptly and correctly and losing the only copy of something. The reverse failure, keeping every leaver's account open indefinitely, is also real: it is standing access nobody is watching, and it appears on your bill.

Add ins, connections, and what they can reach

An add in installed by one person can often read documents that person can read, and sometimes more. A connection between the suite and another system holds a token that survives the password change nobody thought to pair it with.

Establish who may install what, whether an administrator can restrict the catalog, and where to see what is currently connected. Then review that list on the same schedule as your sharing review. The integration surface is the part of this category that most often grows without anyone deciding it should.

Common questions

Is document encryption worth using?

Password protecting an individual file is useful for a specific document sent by a specific route, and it introduces a key management problem you must solve before you rely on it. It is not a substitute for correct sharing, which is where the actual risk sits.

Can we stop people downloading or copying?

You can usually restrict download, printing, and copying. Understand what that achieves: it raises friction and it does not stop anyone who can see the screen from photographing it. Use those controls for the case they suit, which is reducing casual redistribution, and do not treat them as containment.

How do we know what is currently shared?

Look for an administrative report of external sharing and standing links. If your suite does not offer one, that absence belongs in your evaluation, and the feature checks are the right place to test for it.

What is the highest value change for a small team?

Team ownership of documents instead of individual ownership, an expiry on external links, and one quarterly review with a named owner. Those three remove most of what goes wrong here, and none of them cost anything.