> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/public-sharing.md). # Public sharing **SaaS security problem** Sharing company assets publicly means they are accessible to anyone on the web. When employees create new documents in SaaS apps such as Google Drive or Dropbox, they often set permissions to “anyone with a link” so everyone can view, edit or share. This is a convenient option for group collaboration since employees might not want to continually get notifications to approve documents. But it means that company assets are now accessible to anyone on the web. Publicly shared links can easily become overexposed entry points to sensitive data. When these links are shared in publicly accessible locations, such as public Slack channels accessible to all employees, the risk of data breaches and unauthorized access increases. Public sharing often leaves documents exposed, and can cause significant damage if these documents reach someone with malicious intent. {% hint style="info" %} **Did you know?**\ DoControl’s annual SaaS Security Threat Landscape 2023 report audited the number of assets publicly shared across a subset of companies: * In **medium** companies, an average of **6,516** assets stored in SaaS apps are shared publicly * In **large** companies, an average of **94,455** assets stored in SaaS apps are shared publicly **Medium-sized** companies = 50 to 1,000 employees, and **large enterprises** = 1,001 to 6,700 employees {% endhint %} **DoControl solution** DoControl allows you to limit public sharing by approaching SaaS data permissioning from a position of least privilege. You can auto-expire public sharing links to ensure they won’t be found and used by unauthorized personnel. This helps to minimize data overexposure, and mitigate the risk of data loss. DoControl leverages these tools to automatically monitor, mitigate, and remediate the risks associated with public sharing across a variety of apps: * [Inventory](#inventory-of-publicly-shared-assets) * [Events](#events-with-public-sharing) * [Alerts](#alerts-for-public-sharing) * [Playbooks](#playbooks-for-public-sharing) ## What's the risk? Sharing assets publicly means they are now accessible to anyone on the web, outside of the organization. While that might be OK in some cases, you need to be vigilant that internal or sensitive data is not exposed. Sharing a large number of assets publicly over a short time span aggravates the risk of data breaches and unauthorized access. Public sharing can cause significant damage if exposed documents reach someone with malicious intent. ## Inventory of publicly shared assets DoControl's rich inventory exposes publicly shared assets. From the Assets page, you can: * Filter assets per app for public sharing * Remediate assets using [inventory actions](/docontrol-user-guide/workflows/inventory-actions-quick-actions.md), such as removing public sharing The filters for publicly shared assets vary according to app:

SaaS app	Filter for publicly shared assets
Box	Sharing status includes People with the link
Dropbox	Sharing status includes Public
GitHub	Visibility includes Public, Public template
Google Drive	Sharing status includes Public
OneDrive	Sharing status includes Public
Salesforce	Sharing privacy includes Visible
SharePoint	Click the Public assets icon
Slack	Channels > Channel type includes Public
Teams	Click the Public assets icon
Zoom	Sharing status includes Public

#### To filter and remediate assets that are publicly shared: 1. In the Assets page, select the relevant SaaS app. 2. Filter for a **sharing status** that **includes** Public, or any other filter for publicly shared assets. \ For example: Filter for publicly shared OneDrive assets.

3. Select one of more assets. 4. Click the **Remediate > Inventory actions > Remove public sharing**. 5. From the dropdown list, select the relevant workflow. If you don't have one, [create a workflow](/docontrol-user-guide/workflows/create-a-workflow.md) based on the relevant playbook. 6. Click **Trigger workflow**. After confirmation, sharing status of the selected assets is removed.

{% hint style="info" %} For more uses cases of filtering for public sharing in specific apps, see [Assets](/docontrol-user-guide/saas-data-monitoring/inventory/inventory-assets.md). {% endhint %} ## Events with public sharing DoControl monitors real-time events of public sharing. In the Events page you can apply a quick filter to display all events where assets were publicly shared in the last 7 days:

#### To filter events for public sharing: 1. From the DoControl side menu, click **Events**. 2. Select the **Public sharing** quick filter.\ \ ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FqSZiKgvLa9LAJUXLf6tw%2FEvent%20quick%20filters.png?alt=media\&token=582cb6ff-2a4d-4c0e-9dfd-df9c03c76f23) Each [event](/docontrol-user-guide/saas-data-monitoring/events.md) shows user and asset activity, the event type, and raw details in the JSON file. ## Alerts for public sharing DoControl alerts automatically notify your organization when anomalous user behavior occurs. Public sharing alerts indicate that company assets were publicly shared; for example, a Google Drive asset was made public. To mitigate the risk of exposed data as a result of public sharing, DoControl provides these alerts:

Alert type	DoControl alert name	Alert description
DC5	Extensive public burst sharing	This alert will trigger when an internal user publicly shares an anomalous number of assets or assets with a higher than average name sensitivity over a short timespan.
DC6	Public sharing of sensitive files	This alert will trigger when an internal user publicly shares potentially sensitive files. A file is considered sensitive if its name includes one or more sensitive keywords, or a user-defined keyword was detected in the file name.
DC11	External user publicly shared	This alert will trigger when an external user shares assets publicly.
DC105	Unprotected sensitive cloud recording is public	This alert will trigger when an internal user has completed a cloud recording in Zoom that contains potentially sensitive files, is not passcode protected, and can be publicly shared. A recording is considered sensitive if its name includes one or more sensitive keywords, or a user-defined keyword was detected in the recording name.

{% hint style="info" %} For details about DoControl alerts, go to **Help > DoControl Alert Specifications**. {% endhint %} ### How to remediate alerts? If your organization receives alerts notifying you of public sharing, you can delete the relevant sharing link on-demand using the **Remove public sharing** inventory action. You can also set up a workflow that will remove public sharing links whenever a file is uploaded to a public channel (immediately or after a given time frame). When you remove the sharing link, you change publicly shared assets to assets that can only be shared with collaborators (internal or external users). Asset owners will still have access. {% hint style="info" %} You can apply inventory actions to remove public sharing links from assets in these SaaS apps: * [Box](/docontrol-user-guide/workflows/inventory-actions-quick-actions/box-inventory-actions.md#remove-sharing-link) * [Google Drive](/docontrol-user-guide/workflows/inventory-actions-quick-actions/google-drive-inventory-actions.md#remove-public-sharing) * [OneDrive](/docontrol-user-guide/workflows/inventory-actions-quick-actions/onedrive-inventory-actions.md#remove-public-sharing) * [SharePoint](/docontrol-user-guide/workflows/inventory-actions-quick-actions/sharepoint-inventory-actions.md#remove-public-sharing) {% endhint %} ## Playbooks for public sharing To address the use cases of public sharing across various SaaS apps, you can define automated workflows with DoControl's out-of-the-box playbooks. These playbooks will: * Notify your security team whenever an asset is shared publicly (immediately or after a given time frame), or when a GitHub repository is made public * Automatically remove public sharing links, including from files with a sensitive Google label * Automatically delete shared files that contain PII or sensitive information * Prevent publishing a Google Drive file to the web * Prevent public sharing of sensitive files via private Teams chat

Select a predefined DoControl playbook to remediate public sharing

Playbook name	SaaS app	Playbook description
Auto-expire public sharing	Box	When someone shares a file publicly in Box, the shared links are automatically removed after a defined waiting period.
Remove shared links on-demand	Box	When a user triggers a DoControl inventory action to remove a shared link in Box, the link is automatically removed.
Change visibility of shared link	Dropbox	When someone changes the shared link visibility for a Dropbox asset, you can automatically notify the Security team and remove shared links.
Notify on public file sharing	Dropbox	When someone creates a public link for a Dropbox asset, you can automatically notify the Security team.
Remove publicly shared link upon creation	Dropbox	When someone creates a publicly shared link for a Dropbox asset, you can automatically notify the Security team and remove the shared links.
Notify on changing a shared link to public	Dropbox	When someone changes the sharing link visibility to public for a Dropbox asset, you can automatically notify the Security team.
Notify on publicizing a repository	GitHub	When someone makes a GitHub repository public, you can automatically notify the Security team.
Remediate public over-exposure with a loop function	Google Drive	When someone shares a file publicly in Google Drive and approval is not given, the public sharing link is automatically removed from the asset. If approval is given, a 30-day grace period will elapse until sending the approval request again.
Remove public sharing of files with sensitive Google labels	Google Drive	When someone shares files publicly in Google Drive with a sensitive Google label, such as "Restricted," the public sharing links are automatically removed from the assets, and the actor is notified in Slack. If the SecOps team approves the file sharing, the public sharing links are not removed.
Remediate public sharing of PII	Google Drive	When someone publicly shares a sensitive file in Google Drive, the file is scanned for PII labels: If the probability of containing PII is high, any publicly shared links are removed, and the actor is notified by email. If the probability of containing PII is medium, an approval request is sent to the actor to approve the public file sharing. If he doesn't approve, publicly shared links are removed. If the probability of containing PII is not medium, 30 days must pass before asking the actor to approve the public file sharing. If he doesn't approve, publicly shared links are removed.
Remove public sharing	Google Drive	When someone publicly shares a file in Google Drive, the actor is notified by email, and any publicly shared links are automatically removed.
Remove public sharing link on-demand	Google Drive	When a user triggers a DoControl inventory action to remove a publicly shared link in Google Drive, the link is automatically removed.
Auto-expire public sharing	Google Drive	When someone publicly shares a file in Google Drive, the actor is notified by email. After a 30-day grace period, any publicly shared links are removed.
Remove public sharing of sensitive files	Google Drive	When an alert is triggered for publicly sharing sensitive files in Google Drive, any publicly shared links are removed.
Notify and remediate publishing a file to the web	Google Drive	When someone publishes a Google Drive file to the web, you can remove the URL of the file so it's no longer public or searchable on the web.
Notify on public file sharing	OneDrive	When someone from a specific group shares a file publicly in OneDrive, the security team is notified in Slack.
Remove public link on-demand	OneDrive	When a user triggers a DoControl inventory action to remove a public link in OneDrive, the link is automatically removed.
Notify on public sharing	SharePoint	When someone from a specific group shares a file publicly in SharePoint, the security team is notified in Slack.
Remove public sharing on-demand	SharePoint	When a user triggers a DoControl inventory action to remove a public link in SharePoint, the link is automatically removed.
Notify and remediate public sharing of sensitive PII	SharePoint	When someone publicly shares a file in SharePoint, the file is scanned for PII labels. If PII labels are found, the relevant manager or security team is notified by email and webhook, and the public links are removed from the file.
Notify on public file sharing	Slack	When someone from a specific group shares a file publicly in a Slack channel, the security team is notified in Slack.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/public-sharing.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.