The whole team logs into the same Google Drive account with the same password, how risky is this, what's the alternative?

we were doing this too..... anyway when we got google workspace we set up shaed drive, it was great

Google Workspace > Shared Drives > Access permissions can be set granularly.

Thanks for writing this, that's the right way. Forgotten test environments are more often the entry point than live systems.

This thread is archived.

If I understood correctly, you're saying: When making decisions, write down the worst-case scenario too, not just the best.

If you post the result here, it will help others too.

There are three things to check when doing this. An untested backup is not a backup.

The biggest time-waster for us was not knowing who had the final say. Of course, it varies if your situation is different.

i'm writing this so you don't make the same mistake then btw security isn't absolute; it's about making attacks not worth the effort.

if I were you, Id go this route.

We need to make a distinction here. The biggest time-waster for us was not knowing who had the final say.

If I were you, I'd go this route.

I felt relieved reading this answer, so it's not just me. The real issue isn't the number, but what it's based on.

Good luck with that.

We experienced almost the exact same thing last year. honestly just because everyone does it doesn't mean it's right.

An untested backup is not a backup. I'm also curious if anyone does it differently.

im in the same situation, thats why Im asking. tbh mistakes made on the cloud account sharing side are usually reversible but expensive.

if I were you Id go this route.

I've been down this road, let me tell you. If you scold false alarms, nobody will report again.

If you have questions, write them; I'll answer as best I can.

I'm writing this so you don't make the same mistake. Don't hesitate to ask; those who don't ask always pay more.

Having backups accessible on the same network and with the same identity makes them part of the target. Good luck with that.

I feel the same way. An untested backup is not a backup.

Good luck with that.

There are three things to check when doing this. If 2FA is on, a stolen password alone is useless.

Let me summarize what's been said so far. Just because everyone does it doesn't mean it's right.

Do you think this works at any scale? People defend habits, not processes. Resistance comes from there.

Let me summarize what's been said so far. An automated scan report is not the same as a penetration test.

Mistakes made on the cloud account sharing side are usually reversible but expensive. Proven by experience.