File Sharing Security on a Local Network

Sharing files between devices at home or in a small office feels like something that needs no thought. Right-click, share, done. The files stay on your own network, so what could go wrong.

Two things, in fact. First, a local network is rarely as small as imagined. Second, a folder shared for one short-lived purpose is almost never unshared afterwards.

Who is actually on your network

A shared folder is visible to everyone on the same network. In a single-family home that may genuinely be just you. But the list is usually longer:

• Guests who were once given the Wi-Fi password, on devices that remember it forever.
• Neighbours or tenants, if the password ever spread. How to check: seeing who uses your Wi-Fi.
• Smart devices such as TVs, cameras, and speakers. These are the most likely to carry an unpatched flaw (smart home device security).
• Visitors' work devices, which may be carrying a problem picked up elsewhere.

That's what makes a password-free share a problem. Not because there's an intruder, but because "the local network" turns out not to be a closed circle.

Four things that remove most of the risk

1. Never share without a password. In Windows the setting is called password-protected sharing, and turning it off means anyone on the network can open the folder unchallenged. Leave it on, without exception.

2. Share a folder, not a whole drive. Sharing the C drive means sharing everything on the computer, including things you never intended. Create one folder for sharing, and share only that.

3. Grant read-only where that's enough. Most sharing is for others to read. Write access means your files can be changed or deleted, and that's exactly what ransomware uses once it reaches one device on the network.

4. Mark networks outside your home as public. That's what Windows and macOS ask when joining a new network, and the answer decides whether your computer may be visible to others. For rented rooms, hotels, cafes, and other people's offices, the answer is always public. Related reading in using public Wi-Fi safely.

Separate what shares from what doesn't

If guests need internet at your home or business, a guest network settles this entire chapter at once. Devices on the guest network can't see devices on the main one, so your shared folders never sit in the same space as a visitor's phone. Steps in separating a guest network.

The same principle covers smart devices. A TV never needs to open your documents folder, and separating it removes the possibility without having to trust the TV's security.

If sharing is frequent, move it to network storage

Sharing from a laptop has a practical weakness: the files exist only while that laptop is on and at home. Once sharing becomes routine, network storage is far tidier. It offers separate accounts per person, per-folder permissions, and backups that run themselves. Options in choosing network storage, and backup setup in automatic backups.

Three things to do on a storage device before using it: change the default password, create separate accounts per person rather than one shared login, and enable automatic updates (firmware updates apply equally here).

Reaching files from outside

This is the part most often done wrong, and the riskiest. File-sharing protocols were designed for closed networks, not the internet. Exposing their ports through port forwarding invites the whole internet to knock, and automated scanners find it within hours. Several of the largest ransomware outbreaks entered this way.

Two correct approaches:

• A VPN into your home network. You appear to be at home, and no sharing port is exposed at all. Many routers already include this.
• Your storage maker's official service, which handles outside connections without opening anything on the router.

The risks of opening ports, and when it's justified, are in port forwarding on your router.

Cleaning up what's already there

Shares accumulate unnoticed, because nothing reminds you. Once a year, review:

• The list of currently shared folders on each computer. There's nearly always one created years ago to move a single file.
• Accounts that still have access on network storage, including those of people who no longer work or live there.
• Devices still joined to your Wi-Fi (devices on your network).

If your Wi-Fi password is old and has been handed out widely, changing it is the fastest way to empty that list (changing your Wi-Fi password). And if there are signs your network has been compromised, the steps are in what to do after your Wi-Fi is hacked.

Frequently asked questions