> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/personal-account-sharing.md). # Personal account sharing **SaaS security problem** Personal sharing occurs when employees share data with their own personal email accounts. Employees, especially when they're about to leave, might think that company assets, such as customer contacts and product roadmaps, are theirs to take. This opens the door to data exfiltration and increased risk of account takeover attacks, during and even after employees have left the company. Usually personal accounts are non-corporate and unauthorized email accounts, To make matters worse, most personal email accounts do not have security measures such as multi-factor authentication (MFA), making them the weak link in any chain of enterprise security solutions and increasing potential exposure. Basic sharing permissions within SaaS apps allow for anyone with access to sensitive data to exfiltrate it to personal accounts for their own unmonitored use. **DoControl solution** DoControl allows you to limit personal account sharing by approaching SaaS data permissioning from a position of least privilege. You can remove unauthorized access from shared assets. This helps to minimize data overexposure, and mitigate the risk of data loss. DoControl leverages these tools to automatically monitor, mitigate and remediate the risks associated with personal account sharing across a variety of apps: * [Alerts](#alerts-for-personal-account-sharing) * [Playbooks](#playbooks-for-personal-account-sharing) ## What's a personal account? A personal account is an employee's own email account. Usually personal accounts are non-corporate and unauthorized email accounts, which might not meet your organization's security standards. A non-business contact that originates from a free email account, such as gmail or yahoo, could be an attempt to exfiltrate data. These email platforms as a rule do not require multi-factor authentication (MFA), which makes them the weak link in any chain of enterprise security solutions. ## What's the risk? Personal sharing occurs when employees give themselves access to organizational assets and data through their own personal email accounts. This opens the door to exfiltration during and even after their employment. Access might be shared with a third party – a vendor, a colleague, a friend, or even a competitor. After an employee resigns or is terminated, they should no longer have access to sensitive company data. Personal email platforms as a rule do not require multi-factor authentication (MFA), which makes them the weak link in any chain of enterprise security solutions. ## Alerts for personal account sharing DoControl alerts automatically notify your organization when anomalous user behavior occurs. External sharing alert types indicate excess permission privileges that were granted to external users outside your organization; for example, assets shared with personal email accounts. To mitigate the risk of exposed data as a result of sharing with personal email accounts, DoControl provides these alerts:

Alert type	DoControl alert name	Alert description
DC8	Shared sensitive file with personal email	This alert will trigger when an internal user shares potentially sensitive files with their own personal email account. A file is considered sensitive if its name includes one or more sensitive keywords, or a user-defined keyword was detected in the file name.

### Alert summary

The links in the Alert summary display enriched metadata about the actor, target and shared files:

Link	Content
Actor's organization email	Opens the Internal user page listing the user's assets
Sensitive files	Opens the Asset page listing sensitive assets shared by the actor
File link	Opens the Asset page with event and collaborator details related to the specific file
Actor's personal email	Opens the external user page listing the user's assets and events
Keyword	Opens the default sensitive keyword list in Settings > Lexical lists

When you click the **actor's personal email**, you can view all events where this actor shared assets with his or her personal email, and triggered workflows or alerts as a result.

{% hint style="info" %} For details about DoControl alerts, go to **Help > DoControl Alert Specifications**. {% endhint %} ### How to remediate alerts? If your organization receives alerts notifying you of personal account sharing, you can delete the relevant collaborators on-demand using the **Remove external collaborators** inventory action. You can also set up a workflow that will remove external collaborators whenever a file is shared with a personal email account (immediately or after a given time frame). DoControl's remediation measures for personal account sharing are according to SaaS app: * **Box, OneDrive, SharePoint** - With DoControl, you can remove external sharing permissions from the exposed assets. It is also recommended to set up a workflow that will auto-expire or prevent sharing data with private emails. * **Dropbox** - In the Dropbox console, you can remove specific external collaborators by hovering over the asset you’d like to manage and click the share icon. In the dialog box, click on the "X people have access" link to select which collaborators to remove. Alternatively, you can remove the sharing link altogether. * **Google Drive** - With DoControl, you can remove external sharing permissions from the exposed assets, or deny the target's access to any asset in Google Drive. It is also recommended to set up a workflow that will auto-expire or prevent sharing data with private emails. {% hint style="info" %} You can apply inventory actions to remove external collaborators from assets in these SaaS apps: * Box * Dropbox * Google Drive * OneDrive * SharePoint {% endhint %} ## Playbooks for personal account sharing To address the use cases of personal account sharing across various SaaS apps, you can define automated workflows with DoControl's out-of-the-box playbooks. These playbooks will: * Automatically remove external collaborators from Google Drive, Box, and Microsoft 365 assets. * Define timeframe to automatically remove external collaborators from Google Drive assets. * Remediate a suspended or terminated employee's personal email access to Google Drive or Okta.

Select a predefined DoControl playbook to remediate risks from personal account sharing

Playbook name	SaaS app	Playbook description
Remove sharing with personal email	Box	When someone shares a file from Box with their personal email account (as verified by the HRIS app), both the actor and manager are notified, and the external collaborators are automatically removed.
Remove sharing with personal email	Google Drive	When someone shares a file from Google Drive with their personal email account (as verified by the HRIS app), both the actor and manager are notified, and the external collaborator set with personal emails is automatically removed.
Remediate suspended employee's personal email access to Google Drive	Google Workspace	When a employee is suspended from Google Workspace, DoControl automatically runs an API to remediate any Google files that were shared with the employee's personal email account. If the remediation action doesn't complete successfully, the Security team is notified, and the remediation is run again after a defined time interval.
Remediate terminated employee's personal email access to Google Drive	Okta	When a employee is terminated by deactivating their Okta account, DoControl automatically runs an API to remediate any Google files that were shared with the employee's personal email account. If the remediation action doesn't complete successfully, the Security team is notified, and the remediation is run again after a defined time interval.
Remove sharing with personal email	OneDrive	When someone shares a file from OneDrive with their personal email account (as verified by the HRIS app), both the actor and manager are notified, and the external collaborators are automatically removed.
Remove sharing with personal email	SharePoint	When someone shares a file from SharePoint with their personal email account (as verified by the HRIS app), both the actor and manager are notified, and the external collaborators are automatically removed.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/personal-account-sharing.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.