📁 Lesson 4.3: Shared Drives vs My Drive, and Security Best Practices

🏠 Two Homes for Files: My Drive vs Shared Drives

Everything you've filed so far lives in My Drive — your personal space, where every file has a single owner: you. When you share a file from My Drive, you're lending others access to your file. You remain the owner; if you ever left, deleted your account, or transferred out, those files would go with you. For personal use, that's exactly right.

A shared drive flips the ownership model. Files in a shared drive belong to the team, not to any one person. There's no single owner to lose. People are members of the shared drive with roles, and when someone leaves the organization, the files simply stay — the team still owns them. Think of My Drive as your personal filing cabinet and a shared drive as the team's filing cabinet in a shared office: staff come and go, but the cabinet and everything in it stays with the office.

🤝 When a Shared Drive Beats a Shared Folder

Both a shared folder (in My Drive) and a shared drive let a group work together, so when does the shared drive genuinely win? The answer almost always comes down to one word: continuity.

So the rule of thumb is simple. If files really belong to a person and you're just giving others access, a shared folder is perfect — and it's what you'll use on a free account. If files really belong to a team and must outlive any individual coming or going, a shared drive is the right home, because nobody's departure orphans the work. This is the clean answer to the ownership-transfer headache from Lesson 4.2: instead of remembering to hand files off when someone leaves, put team files where no one person owns them in the first place.

🎫 Shared-Drive Membership Roles

Just as individual files have Viewer/Commenter/Editor, a shared drive has membership roles that govern what each member can do across the whole drive. The exact names and set of levels can vary by edition and change over time, but the shape is consistent — from most to least powerful, roughly:

• Manager — full control: manage members and their roles, and delete the shared drive itself.
• Content manager — add, edit, move, and delete content, but not manage membership.
• Contributor — add and edit files, without the broader management powers.
• Commenter — comment on files but not change content.
• Viewer — read only.

The same least privilege principle from Lesson 4.1 applies, just at team scale: give each member the lowest role that lets them do their job. Not everyone needs to be a Manager "to be safe" — in fact, keeping the Manager role to a trusted few is exactly the safe choice, since Managers can add people and even delete the whole drive.

🛡️ Security Best Practices: The Core Habits

Now the part that protects everything you've built. Careless sharing is the single biggest risk in cloud storage — not hackers breaking in, but files quietly handed to the wrong people, or links traveling further than intended. The good news: a handful of durable habits make you genuinely safe. None of them are technical. They're just deliberate.

1. Least privilege — the golden rule

Give every person the lowest access that still lets them do what they need. Read only? Viewer. Feedback? Commenter. Building it with you? Editor. It's always easy to grant more later; it's the over-granting you won't notice that hurts you. This one principle underlies almost every other habit here.

2. Prefer specific people over public links

Default to inviting named people by email. Reach for "anyone with the link" only when something is genuinely meant to be public. A link is not a password — it forwards, pastes, and travels. When content is sensitive, naming the people is the safe, on-purpose choice.

3. Review your shared items periodically

Access accumulates silently. Once a quarter, spend ten minutes reading the access lists on your most sensitive files and folders, and remove anyone who no longer needs to be there. Check that nothing important is accidentally public. (That's the audit habit from Lesson 4.2 — now make it routine.)

4. Be careful what you put in shared or public files

The safest data breach is the one that can't happen because the sensitive information was never in a shared file. Keep passwords, financial details, ID numbers, and other private data out of files that are shared broadly — and especially out of anything set to "anyone with the link."

🎣 Phishing, Fake Shares & Sensitive Data

Because "someone shared a file with you" emails are so normal, scammers imitate them. A fake-share phishing message looks like a Drive or Docs sharing notification — "So-and-so shared 'Invoice' with you" — but the button leads to a fake sign-in page designed to steal your password, or to a malicious file. It works by borrowing the trust you place in a familiar, everyday notification.

You don't need to be paranoid — you need a few tells. Before clicking a share notification, pause and check:

• Do you know the sender, and were you expecting this? An unexpected share from a stranger, or a document you have no reason to receive, is a red flag.
• Does the sign-in page look right? If a link asks you to "sign in to Google" again on an odd-looking page, stop. Real Google sign-in lives on Google domains — when in doubt, go to drive.google.com directly rather than through the email.
• Is there pressure or urgency? "Your account will be closed," "review immediately" — urgency is a classic manipulation tactic.
• Does the file want you to enable something or download an executable? Be very wary.

The safest universal habit: when a share email feels even slightly off, don't click the button — open Drive yourself and see whether the file is genuinely there in "Shared with me." Even if something does show up there, check who shared it — a file from a stranger or an odd address can still be a lure.

🔐 Lock Down Your Account: 2-Step & Admin Rules

All the careful sharing in the world rests on one thing: your account staying yours. If someone gets into your Google account, they get into your entire Drive. So the highest-leverage security step in this whole course isn't a Drive setting at all — it's protecting the account itself.

Turn on 2-step verification

2-step verification (also called 2-factor authentication, or 2FA) means that even if someone learns your password, they still can't get in without a second factor — a prompt on your phone, a code, or a security key. It is the single most effective thing you can do to keep your account safe, and it's free. You turn it on in your Google Account's Security settings. If you do only one thing from this lesson, do this.

On Workspace accounts, your admin has a say

If you use Drive through a work or school Google Workspace account, remember that an admin may set organization-wide rules: whether you can share outside the company, whether public links are allowed at all, retention and deletion policies, required 2-step, and more. If a sharing option you expect is missing, it may be org policy, not a bug. When in doubt, ask your IT or admin team — those rules usually exist to protect everyone's data, including yours.

🎯 Project: Shared Drive & Security Review

Two parts. The first is Workspace-only, so do it if you can and reason through it if you can't; the second — the personal sharing-security review — everyone can and should do, and it's the more important half.

My sharing security review
- Shared items checked for stale access? Y/N
- Anything "Anyone with the link" that shouldn't be? Fixed? Y/N
- Sensitive data out of shared/public files? Y/N
- Least privilege — everyone on the lowest role that works? Y/N
- 2-step verification ON? Y/N
- Recovery phone + email set? Y/N
- (Work/school) Any missing option that's likely admin policy? note it

Redo this review once a quarter.

Best Practices for a Secure, Well-Owned Drive

✅ Do's

• Put team files in a shared drive when continuity matters, so no one person's departure orphans the work.
• Apply least privilege everywhere — files and shared-drive membership alike.
• Turn on 2-step verification. It protects your entire Drive at once, and it's free.
• Verify share emails by opening Drive directly rather than clicking the button.

❌ Don'ts

• Don't put secrets in shared or public files. The safest breach is the one that can't happen.
• Don't type your password into a page you reached from an emailed link. That's how accounts get stolen.
• Don't assume a missing option is a bug on a work account. It's often admin policy — ask IT.

📓 Learning Journal

📝 Lesson Summary

🎉 What You've Accomplished

You've completed the sharing module — and you did it the right way, ending on safety. You understand where files live and who owns them, when a team needs a shared drive, and how to keep everything secure with habits that require no technical skill at all. You ran a real security review of your own Drive and, ideally, switched on 2-step verification. That's not just knowledge; it's a genuinely safer digital life, built by you.

❓ Common Questions at This Stage

🔭 Looking Ahead

In the next lesson — Lesson 5.1: Drive for Desktop — Sync & Stream Your Files — we move into the final stage of our model, Sync. You'll connect Drive to your computer so your files live on both your desktop and the cloud, learn the difference between syncing and streaming, and set up offline access — turning Drive into a home base that follows you onto every device.

✅ Before the Next Lesson

• Complete Part B of the project — the personal security review — even if you skipped Part A
• Confirm 2-step verification is on and your account recovery is set
• Write your Learning Journal entry for this lesson

📚 Additional Resources

• Google Drive Help Center (Google Support)
• Google Drive on Google Workspace (shared drives & editions)
• Google Drive Help Community