Is Dropbox secure?

Dropbox can be a useful file-sharing service, but is it really fit for use in business?

Dropbox was, for a long time, the go to example when people wanted to talk about shadow IT. Fast, convenient and free, it became almost the de-facto way for employees to share documents with colleagues and access them outside of work.

But this convenience came with a price - low security. While this may not be so much of an issue when users are dealing with their own personal data - it is, after all, their own information to use as they wish - it can present serious consequences for businesses, both from a regulatory and an operational perspective.

Since then, Dropbox has made serious attempts to "go straight" in the business space, introducing Dropbox for Teams - now Dropbox for Business - and emphasising security with features like single sign-on (SSO), remote wipe and audit logs.

Yet the question remains - is Dropbox really secure? Can a consumer service retrofitted for the business space ever be safe enough?

Advertisement - Article continues below
Advertisement - Article continues below

First, it is important to realise that there is no such thing as total security.

It has become a clich among the security community to say "it's not if you suffer a breach, it's when" and while this, in my opinion, is a slight over exaggeration, it is reflective of the fact nothing can ever be 100 per cent secure, be it Dropbox, products that were built from the ground up for business, or your own internal systems.

The question, then, becomes "does this product offer an acceptable level of risk?"

The truth is that, despite its reputation as a spreader of data insecurity within companies, Dropbox for Business can be equally as secure as other solutions, including rivals such as Box, Mozy, SugarSync, Acronis or even Amazon S3. Like them, it offers SSL/TLS encryption for data in transit, AES encryption for data at rest, as well as admin features like SSO, two-factor authentication (2FA), remote wiping and shared audit logs.

It has also seemingly recognised the original "shadow IT" problem it created and in 2013 it began to offer personal and professional account linking.

Ilya Fushman, who at the time was head of product, business and mobile at Dropbox, said the feature had been introduced as a result of people being forced to put personal files in their Dropbox for Business account to access them at work.

Advertisement - Article continues below

"As we got more excited about building more features for Dropbox for Business, we kept running into the same problem: just as people often work at home, they also want to have their personal files with them at the office. We needed to build a way to help people keep their stuff separate, but still make both sets available from everywhere," Fushman said in a blog post.

"Each Dropbox will be properly labelled for personal or work, and come with its own password, contacts, settings, and files," he added.

But any solution is only as secure as its weakest link, and at this point it is in the hands of the IT administrators to bring in both a user education programme and the appropriate processes to ensure what data is stored where is compliant with legislation.

Dealing with the latter of these two points first, just because Dropbox is "secure" does not mean it is secure enough to comply with data protection legislation for certain types of data. For example if there is personally identifiable information or data that has to stay within the UK or EU then Dropbox would likely be unsuitable, as all its data centres are located in the US.

Advertisement - Article continues below

Therefore, other data management tools should be put in place to prevent data of this kind from being transferred into Dropbox, or any other inappropriate storage service or device.

Education is an important part of reinforcing security in any setting. When it comes to Dropbox, IT administrators should explain to users how to use Dropbox for Business and its various collaboration and sharing features safely, as well as helping them to link their personal and business accounts if they wish to.

Advertisement - Article continues below

Any restrictions, from not putting business information into their personal account to being prevented from adding certain files to Dropbox at all, should be clearly communicated, both to avoid any accidental breaches and reduce frustration.

So, is Dropbox secure? Well, depending on your appetite for risk, yes it can be - but admins still have their part to play in ensuring that security.

Featured Resources

Digitally perfecting the supply chain

How new technologies are being leveraged to transform the manufacturing supply chain

Download now

Three keys to maximise application migration and modernisation success

Harness the benefits that modernised applications can offer

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now


internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019
network attached storage (NAS)

Best NAS drives 2019

26 Apr 2019

Most Popular

operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020
General Data Protection Regulation (GDPR)

Data protection fines hit £100m during first 18 months of GDPR

20 Jan 2020