Five habits that keep file server access from spiralling out of control

Key points

• File servers, the shared drives where staff keep documents, still hold much of the working data inside most companies.
• Permissions drift over time as people change jobs, projects end and old access is rarely revoked.
• The Austrian software firm tenfold recommends five habits to keep access tight, including regular reviews and clear ownership of folders.
• Least-privilege access, meaning each person can only open what their job requires, remains the single biggest defence against ransomware spreading.
• Automated tools can flag risky permissions faster than manual audits, but the discipline still has to come from management.

File servers sound like something from an earlier decade. They're not.

Walk into almost any hospital or law firm and you'll find a shared drive stuffed with contracts, patient notes and finance spreadsheets. Staff open them every day without thinking. That quiet middle layer of company life is exactly where ransomware, the kind of malicious software that scrambles files and demands payment, does the most damage when it gets in.

A new guide from tenfold Software, an Austrian identity management vendor, argues that most of the risk comes from something duller than hacking: permissions handed out years ago and never taken back. The guide was first flagged by BleepingComputer.

Why do file server permissions get so messy?

People move around and access rarely follows them. Someone joins marketing, gets added to a folder, moves to sales, keeps the old access, then covers for a colleague in finance and picks up more. Multiply that by a few hundred staff over five years and the picture gets ugly fast.

When a criminal steals one employee's password, they inherit every folder that employee can reach. If that employee has quietly accumulated access to payroll and client contracts, the attacker has a very good day. It's the kind of exposure that doesn't require a sophisticated intrusion, just a stolen credential and a poorly maintained permission tree.

What are the five habits tenfold recommends?

Know what you have, give out less, review often, name owners, and automate the paperwork.

None of this is glamorous. That is rather the point.

Who should actually own a folder?

Not the IT team. The person in the business who understands what the files are for. IT can set up the permissions, but only the head of HR knows who should see salary data.

When ownership sits with IT by default, requests get rubber-stamped because the ticket queue is long and nobody wants to be blocking the sales team on a Friday afternoon. Named business owners break that pattern. It's a structural fix, not a technical one, and it's the part most organisations skip.

Does automation really help, or is it just another product to buy?

It helps when the manual version has already collapsed. Two administrators looking after twenty thousand folders can't review access by hand, so they stop trying. Software that lists who has access to what, flags dormant accounts and routes approval requests to the right owner turns a task that never gets done into one that does.

The caveat: a tool without a policy behind it just automates the mess. We covered a related problem on 26 June 2026 when Robinhood rebuilt its access-approval pipeline to get speed without losing control. The lesson there was the same: tooling follows process, not the other way round.

What ordinary staff can do

Two small habits matter. Don't save personal copies of sensitive files to your own desktop, and tell IT when you change roles so old access gets removed. The heavy lifting sits with the people running the servers, but attackers count on staff hoarding access quietly. They're usually right.

File servers aren't going anywhere. Neither is the ransomware crews' interest in them.