Data Sharing and Storage Best Practices

• Data Classification:
  Not all data is equal. Employees must classify data before sharing:

  • Public: Marketing brochures, press releases. (Low Risk)

  • Internal: Employee directories, policy manuals. (Medium Risk)

  • Confidential: Client lists, pricing strategies, unpublished code. (High Risk)

  • Restricted: SSNs, Patient Health Info (PHI), Credit Card numbers. (Critical Risk – Requires Encryption).

• Secure File Transfer vs. Email:

  • Email:
    Standard email is not encrypted by default. Never send “Confidential” or “Restricted” data as a plain email attachment.

  • Secure Solution:
    Use approved Secure File Transfer Protocols (SFTP) or encrypted email gateways (e.g., Mimecast/Zix) that require the recipient to log in to view the message.

• Cloud vs. Local Storage:

  • Local Storage:
    Saving files to your laptop desktop is risky. If the laptop is lost or broken, the data is gone.

  • Cloud Storage:
    Use corporate-sanctioned cloud storage (e.g., OneDrive for Business, Box). This ensures data is backed up, encrypted, and accessible to the team if you are unavailable.

  • Shadow IT Warning:
    Do not use personal Google Drive or Dropbox accounts for work files. This bypasses corporate security controls and is a common cause of data leaks.

• USB & Removable Media:

  • Avoid using USB drives unless absolutely necessary and approved.

  • USB Drop Attacks:
    Criminals leave infected USB drives in parking lots labeled “Payroll” or “Bonuses.” Plugging one in can instantly compromise the network.