Friday, March 29, 2013

SkyDrive Security


Do you use SkyDrive only for storing photos and miscellaneous files?  What about important correspondence or files containing personal information?  What about sensitive files such as tax returns or copies of bank statements?

The question about sensitive information was raised in the comments of my article Moving to SkyDrive regarding the security for sensitive files on SkyDrive:
"Is Skydrive suitable as a place to sync/save sensitive information (e.g. tax/financial records) or is it just really for things like photos, unimportant Office files etc? It would make things simpler for me if I could use Skydrive to sync all my files including the sensitive ones, but I am hesitating on security grounds."
In retrospect, my immediate reaction to the question was short-sighted:
"Short answer: Yes, sensitive documents (e.g. tax/financial records) saved to SkyDrive are secure. The only way to access those files is by secure logon with your Microsoft Account.

That raises the reminder of ensuring that a strong/unique password is used for your Microsoft Account. For additional information regarding a strong password, see Password Generator & Checker | How Secure is my Password.

Additionally, regardless of whether anyone uses SkyDrive or not, I strongly recommend taking the steps to protect your account. This article written for "Hotmail" equally applies to the revamped Hotmail Security to Protect and Recover Your Account ~ Security Garden."
Why, after reconsideration, do I consider my response short-sighted?  Let's take a closer look at transporting and accessing files on SkyDrive.

Transporting Files to SkyDrive

When saving your files to SkyDrive, the method used for transport encryption of your data from your computer to SkyDrive is called Secure Socket Layer, or SSL.  SSL protocol uses standard key cryptographic techniques for the communication session between the client (your computer) and server (SkyDrive).

Thus, during transit from your computer to SkyDrive, your data is protected from interception and is reachable and readable only on SkyDrive. However, it is important to consider that SkyDrive does not include any additional encryption on the files after being uploaded.

Update 06Dec2013:   Please see this important information by Brad Smith, General Counsel & Executive Vice President, Legal & Corporate Affairs, Microsoft, about plans to strengthen the encryption of customer data across Microsoft networks and services. Protecting customer data from government snooping.

Accessing Files on SkyDrive

The default setting of files saved from your computer to SkyDrive is set to "only me".  Thus, no one can view your files and documents without your consent unless you intentionally select the folder and change the setting. (See this Microsoft help document for instructions on how to Share files and folders and change permissions.)

In other words, the only way to access the files set to "only me" is by logging on to SkyDrive with your Microsoft Account.  But, what if your Microsoft Account is compromised or if you inadvertently change the setting to public?

Another situation that could compromise the security of sensitive information is that anything uploaded via a mobile device is automatically stored in the Mobile uploads folder.  Fellow Microsoft MVP, Richard Hay, discovered recently that the Mobile uploads folder in the SkyDrive cloud storage is set by default as Shared with Friends.  The default setting can be changed by logging on to your SkyDrive account via your browser.

Securing Sensitive Files

There should be no concerns about security of your files stored in a private folder on SkyDrive, accessible only by you when you logon with your Microsoft Account.  However, for sensitive files, you may want to add an additional layer of protection to those files.

The easiest method is password protecting Microsoft Office files, illustrated in this Office support document:   Protect your document, workbook, or presentation with passwords, permission, and other restrictions.
Important:  Be careful to note somewhere offline the password used to protect your Office files.  There is no way that Microsoft can help you retrieve forgotten passwords.

Ben Herila of Microsoft provided additional methods of protecting your data on SkyDrive in his post in How secure are files on SkyDrive?:
"Some examples of methods that will protect your data on SkyDrive include: 
  • Password protected RAR or 7Z archives
  • Password protected Office 2010+ documents or 
  • PDF documents with AES-256 encryption PGP-encrypted files"
For particularly sensitive information, I suggest you read both How secure are files on SkyDrive? and Microsoft account, Hotmail, SkyDrive.

~   ~   ~   ~   ~   ~

This program has been discontinued. As a SkyDrive Insider, I am excited to share information about SkyDrive.  If you have a question about this post, please leave a comment and I'll do my best to assist.

Learn more about the SkyDrive Insiders program here.


Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...


Anonymous said...

Hi - We're thinking of adopting SkyDrive for use with students are who undertaking a trial of Android tablets & iPads in lessons. We have a windows network, so SkyDrive is a good option for file creation, storage & sharing between that and non-native devices.

We think we have a duty of care to ensure 'safeguarding' within these SkyDrive accounts (most students are under 16). Have you any ideas how we might be able to setup accounts that can be moderated by an administrator?

Richard C.

Corrine said...

Hi, Richard C.

I suggest creating a separate folder for each student on the school's SkyDrive account. Then provide edit permission individually to the students for their assigned folder, also requiring them to log on in order to access the folder.

For instructions on how to share files and folders, see Share files and folders and change permissions - SkyDrive

Anonymous said...

Thanks, Corrine. Very helpful - I'll give it a go!

Richard C.

Unknown said...

The easiest and most certain method of ensuring your files are safe on Skydrive is by using encrypted containers. For example, my passwords are in a TrueCrypt container which is only mounted as needed and synced in with my SkyDrive app. This makes for a really hard time to read the contents.

Unknown said...

Like you've said, encryption shouldn't be an issue for most SkyDrive users, or users of other online drives, if the folder or container in question is not shared to other people. Nevertheless, you can always add your own brand of encryption by placing passwords on the files themselves. This is especially easy to do in most Office files and such. That being said, thanks for further elaborating on your thoughts about SkyDrive. Have a good day!

Tracy | Virtual IT Ltd