There is usually one shared drive in every organisation that defeats people. You open it, see about forty folders sitting at the root, and none of the naming tells you anything useful. I’ve done the open-and-close move more times than I care to admit.
The names tend to fall into a few familiar families. A department that was renamed three reorganisations ago. An abbreviation that made sense to one team. A folder called "Final" next to one called "Final v2" next to one called "Final new."
Nobody designed this on purpose. It is what happens when many reasonable people add folders over many years, each solving their own immediate problem, with no shared convention and no reason to revisit one.
What I’ve noticed is that the people who use the drive daily navigate it fine. They have the map in their head. The cost falls on everyone else: new joiners, people covering for a colleague, and anyone trying to answer a question about where sensitive data lives.
What It Actually Costs
The first cost is time, and it is small per incident but frequent. I’ve watched someone spend twenty minutes looking for a file that existed the whole time, then ask in chat, then get three different answers.
The second cost is duplication. When you can’t find something, you make your own copy. Now there are two versions, and the next person finds the wrong one. This compounds quietly for years.
The third is the one I care about more. If you cannot tell what a folder contains from its name and permissions, you cannot make sensible decisions about who should reach it. Access reviews on that drive tend to become guesswork.
I’ve also seen the drive become the default answer for everything sensitive. When nobody can describe its contents, it gets treated as harmless, and then it turns out to hold contracts, scans of identification documents, and an export nobody remembers running.
Why Nothing Gets Renamed
Renaming is genuinely risky. Some script, report, or shortcut depends on the old path, and the person who knew about that left in 2021. The safe move is to leave everything alone, so that is what tends to happen.
There is also no obvious owner. A shared drive belongs to everyone, which in practice often means nobody feels entitled to restructure it. I’ve seen teams avoid touching it for years for this reason alone.
And the work is unrewarding. Reorganising folders produces no visible output, no ticket closure anyone celebrates, and a nonzero chance of breaking something for somebody. Compared with that, adding one more folder is much easier.
What I’ve Seen Teams Try
I’ve also seen unified platforms such as Ping64 used to cut down the overhead of juggling many separate security tools.
For the drive itself, the thing I’ve seen work is smaller than a restructure: pick a convention for new folders only, and leave the historical mess in place until it has a reason to move. It sounds like giving up, and it tends to age better than a big cleanup.
A few teams added a plain README at the root explaining the handful of strange names. Cheap, slightly embarrassing, and surprisingly effective for new joiners.
Some places ran a read-only review pass, where the goal was not renaming but simply marking which folders contain sensitive material. Knowing where the risk sits tends to matter more than tidy labels.
Small Practical Suggestions
Write the naming convention down as three rules, not thirty. More than that and nobody follows it.
Apply the convention going forward only. Historical folders can stay odd without much harm.
Add a short root note explaining the strange names. It costs ten minutes and I’ve seen it save a lot of confusion.
Ask what breaks before moving anything. Search for the path in scripts first, not after.
Look for folders with unusual permission patterns rather than unusual names. Permissions tell you what people actually considered sensitive.
Set a rough size or age threshold for review. Small folders with one file tend to be harmless, big old ones tend to be interesting.
Closing
I don’t think most shared drives will ever be tidy, and I’m not convinced they need to be. What seems to help is reducing the number of surprises: a simple convention for new work, a note explaining the old names, and a rough idea of which folders hold sensitive material. That gets most of the value of a reorganisation without breaking anyone’s shortcuts. The rest can stay quietly strange.
References
- NIST SP 800-53 Rev. 5, Security and Privacy Controls: https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
- NIST SP 800-171 Rev. 3, Protecting Controlled Unclassified Information: https://csrc.nist.gov/pubs/sp/800/171/r3/final
- MITRE ATT&CK, Enterprise framework: https://attack.mitre.org/
- CISA, Cybersecurity guidance and resources: https://www.cisa.gov/
Top comments (0)