Government file sharing: What IT managers should know

The guilty verdict earlier this year of Russian hacker Yevgeniy Nikulin for hacking Dropbox, LinkedIn and Formspring in 2012 is a timely reminder that file sharing can still pose legitimate security risks, particularly if government employees are considering commercial platforms.

While many tools simplify file sharing, they are typically not up to the levels of security or regulatory compliance that agencies require. In addition, Dropbox has still not been certified by the Federal Risk and Authorization Management Program, which means it is not suited for federal agencies when transferring government content between users. While Box is being used for government applications and complies with FedRAMP as well as HIPAA and other government standards, last year, a white-hat hacker was able to guess the vanity URLs users at many global companies chose for file sharing. So the threat of accidentally leaking sensitive information is still very real even among seemingly security-conscious organizations.

Against that backdrop, some vendors are providing solutions that can limit the security threats posed by file sharing services in government. Here are some factors IT managers must consider when selecting an appropriate solution for their agency’s needs.

Holistic data protection

Obviously, government has a pressing need for a secure place to share and store content, with complete control over where data is located. This need has only been exacerbated by the growth of work from home prompted by the COVID-19 pandemic.

Such applications must offer users the complete file-sharing experience, even while ensuring security. Because file sharing is likely to be a heavily used application, it must also include high levels of fault tolerance and be capable of quickly recovering from any problems arising from its use. The application must also be compatible with both desktop and mobile devices so, that users can sync and share files no matter where they are.

The file-sharing system must be able to control access to sensitive data, authenticate user identities and encrypt data at rest, in use and in motion -- from the core to the edge. Data must, of course, be password protected.

Hardware and virtualized cryptographic key management will ensure that keys are protected and managed. Encryption architecture must be based on each security group having a unique key. These keys must be stored encrypted in the database, and master keys must be stored in a key server, with support for redundant servers.

Practical requirements

Because Office 365 is becoming a de-facto standard in both the public and private sector, any file sharing system used by the government should integrate with it. At the front end, look for solutions where Office documents can be created directly from within the file-sharing application, and any Office document can be opened directly (and securely) within the file-sharing application. Direct integration to Office 365 can also allow any user group to be enabled or disabled as required.

Document versioning and collaboration are also important. Government employees, particularly those in sensitive positions, must be able to keep every version of an uploaded file -- along with notes and comments -- so that any prior versions can be retrieved at any time to facilitate collaboration.

This in turn raises the issue of secure ad-hoc sharing. Such provisions allow files to be conveniently shared with users who may not be enrolled in the protected file-sharing system. Users must be able to download or upload documents and to receive email notifications when files are uploaded or downloaded. Behind the scenes, is important for files to have a configurable expiration date.

Shared links should be manageable from a dashboard view, and links should be revocable, if the need arises. And, as with commercial file sharing services, government-oriented systems must offer the capability to download multiple files as a password-protected ZIP file.

Multi-tenancy is another key requirement -- deployed file-sharing solutions must support multiple missions and projects while keeping the data segregated. A file-sharing solution should offer the ability to create unlimited cryptographic key groups to ensure isolation among separate file sharing missions or groups.  This feature is key for scalability and allows agencies to avoid management sprawl when dividing the capabilities across agencies, customers, partners and mission.

Most of these considerations may seem intuitive or even obvious. In fact, though, many commercial file sharing services do not rise to the level of holistic data protection demanded by government. Becoming conversant with these capabilities will help IT managers ensure that their agency’s file sharing can be effective for users while offering the peace of mind that important data remains protected.