How to find out who is sharing company data externally
If you subscribe to the Enterprise edition, you can use three types of data loss protection: DLP, scanning of incoming and outgoing e-mails for sensitive data, scanning of images for text…
If you use the G Suite Business edition, you can put together a report on what is happening with data in your company. Thanks to the Drive audit, you can keep all file activity under control.
Open your console at admin.google.com.
Click the hamburger menu on the left-hand side of the screen and choose Reports/Audit
When you open Audit, a panel appears in which you can browse information on how heavily Google apps are being used. The sources of the information provided differ depending on your subscription type.
Clicking the Audit/Drive section
displays a list of the activities that have taken place with your data in the company domain. Events are shown going back six months. You can adjust the range of data provided by clicking the “Date range” icon in the top right corner of the screen
To get a better overview of specific events, you can filter by event type by clicking the “+ Add a filter” icon.
You can choose from these types of filtered data:
Event name
Upload (filters files uploaded to Drive)
Remove from folder (traces files being moved between folders in Drive)
Rename (information about the old and new names of folders and files)
Add to folder, and more (information about what is happening in a folder)
Delete (which files were deleted, where and by whom)
Download (which files were downloaded from Drive and by whom)
Print (who printed which file)
Trash
Create (which files were created, by whom and where)
Editor settings change (who granted the right to edit a file, and where)
Shared drive settings change
Sharing permissions change (owner, can view published, can view, can edit, can comment, manager) – an overview of role changes for specific files
Shared drive membership change (an overview of changes to users' rights over folders in a shared drive)
View (an overview of file views in Drive. Useful when working with an external contractor who accesses your data. You get an overview of how many times the contractor has viewed the working file)
Edit (every automatic save of a file is recorded. If you add the file ID as another filter, you will have, for example, an overview of the edits to a shared file under a single filter)
Item name (enter a string from the item name and only files containing that string will be filtered)
Item ID (a unique file identifier in the form 1924BxIbPymQEqRKGDKBhTHAh4lX_Y2oS5vUzttxBXOQ, which unambiguously identifies the file.
Item type (choice of document type)
Shared drive ID (if you want to target the audit at a specific shared drive only)
User name (filters the activity of a specific user)
Owner (a report of activity involving the files of a given owner)
Prior visibility (displays a list of files that previously had the selected visibility set, with the new visibility type shown for each
Private
Anyone in the domain with the link
Anyone with the link
Anyone in the domain
Public on the web
Shared internally
Shared externally
Unknown
Visibility (for example, you filter company files that are shared externally, outside the domain)
Private
Anyone in the domain with the link
Anyone with the link
Anyone in the domain
Public on the web
Shared internally
Shared externally
Unknown
Visibility change (a simple overview of changes to a file's “visibility” inside and outside the domain)
External to internal
Internal to external
None
Where do you find the item/file ID? In Audit, every item has its own unique ID – see the picture
How can you put the audit data to use?
These situations, for example, came to my mind:
You collaborate on an Attendance file across several of the company's centres. Turning on the filters Event name – Edit and file ID blablablabla gives you statistics on the edits to the Attendance file without having to open it and look in the history to see who has already filled it in before the data deadline.
You need to find out who has edit access to which company files “from outside”. You activate the filters Visibility: Shared externally and Event name – Sharing permissions change – can edit. This displays the files that are shared outside the organisation and can be edited by users.
A report that shows us who from outside has access to which file with the right to edit.
How do you keep everything under control in real time?
Create a filter that shows you the data you need. Once you are happy with the output, you can click the bell icon, which starts the setup of an “alert”, a notification that arrives by e-mail the moment the conditions defined in the filter are met.
One example is a situation where you don't want files in the “Patents” folder to be shared outside the company. You set up an alert, and the moment someone with access to the folder shares files outside the folder, you receive a notification.
I think it is worth investing the energy in setting up security rules for company data.