Doki · Infrastructure migration · 2024
Our team shares files on Google Drive, but we often forget to check who can access them. Can former employees still see them? Won't client files get lost?
File permissions should be audited regularly. Check files set to 'Anyone with the link'. Do a monthly permission audit.
it's terrifying if a separated employee still has access to files... anyway we had this issue too we checked all the files
File sharing policy: 1. Require specifying who to add 2. Monthly permission audits 3. Remove former employees 4. Set up company accounts
You can find public files using the 'Shared Drive Report' in Google Admin Console. Take precautions.
Doki · Brand identity · 2025
Could you elaborate on that? Forgotten test environments are more often the entry point than live systems.
Good luck with that.
There's a trap here, let me mention it. If 2FA is on, a stolen password alone is useless.
This is my opinion, I'm not claiming it's absolute truth.
the discussion got scattered let me summarize.. then the real issue isnt the number, but what its based on.
youre right Ive been down that road too but if the notiication path is long notifications dont arrive; missing notifications mean delayed incident detection.
There are three things to check when doing this. When we decide without measuring, we always end up in the same place.
If permission and scope aren't in writing, don't start that test. Proven by experience.
I've been down this road, let me tell you. When you try to change everything at once, nothing settles.
Your time to detect an issue directly determines its cost. That's all, sorry if I went on too long.
There's a common mistake people make when doing this. An automated scan report is not the same as a penetration test.
If 2FA is on, a stolen password alone is useless.
Doki · KVKK compliance consulting · 2024
This is exactly what we experienced. Your time to detect an issue directly determines its cost.
Having backups accessible on the same network and with the same identity makes them part of the target. Proven by experience.
Exactly, and not many people know this. If 2FA is on, a stolen password alone is useless.
The harder it is to reverse a decision, the slower you should make it. This is my opinion, I'm not claiming it's absolute truth.
The opposite happened to me, that's why I'm writing. Start with a small trial; don't commit to everything at once.
If 2FA is on, a stolen password alone is useless. like just leaving this note, it might be useful.