The Hidden Security Risk in Microsoft Teams

You’d think that links shared in private Teams chats stay private, right? Wrong! Every link shared in Teams is stored in Microsoft’s SharePoint (or OneDrive) – and unless you’ve changed the system’s default “most permissible” settings, they become publicly accessible. This means your confidential data could be easier to find than a cat video on the internet.

It’s basically inviting hackers and cybercriminals to access your sensitive internal documents, client data, or financial records. Even a disgruntled ex-employee could wreak havoc.

Unfortunately, because this flaw is fairly well hidden in Microsoft’s system settings, businesses may not even realise they are vulnerable until it’s too late.

via GIPHY

Our CyberGuard security monitoring program is always on the lookout for digital risks, and this one stood out like a sore thumb. We found that links shared within Teams were accessible outside of the intended recipients. After some detective work, we pinpointed the culprit – SharePoint’s default sharing settings, which favour convenience over security.

Realising the potential severity of this issue, NQIT immediately reported the vulnerability to Microsoft. While they’re yet to implement a fix (and we’re not holding our breath), there are proactive steps you can take to keep your data under lock and key.

via GIPHY

To prevent your sensitive info from falling into the wrong hands, we recommend setting up a two-SharePoint strategy:

1. Secure SharePoint for Internal Use Only –  Lock this one down like Fort Knox. Only internal users should have access, with the “least permissible” settings enabled.
2. Public SharePoint for Non-Sensitive Information – For anything that actually needs to be shared externally, use a separate SharePoint that allows public links, but never store confidential business info here.

Also very important: as soon as a staff member leaves, they must be booted from your digital systems!

By making this switch, you can ensure your sensitive data remains protected – whether it’s from hackers, ex-employees, or even just the wrong set of eyes.

via GIPHY