In many organizations, typical spreadsheet usage can be a security risk and violate privacy regulations as sensitive data is downloaded, copied, and shared. Many data teams try to transition business users to more secure BI tools, but most folks ultimately want their data in a spreadsheet and export data out of BI tool dashboards to open in Excel or Google Sheets.
To solve these spreadsheet security issues, teams can try two paths:
- Path 1: Try to lock down Excel
- Path 2: Switch to a secure cloud spreadsheet
In this guide, we'll explore Excel security risks and ways to secure Excel spreadsheets for Path 1. For Path 2, we'll show how a secure spreadsheet like Row Zero can solve your spreadsheet security problems. Row Zero is an enterprise-grade spreadsheet built for big data and modern cloud security.
- Excel security risks
- How Excel use may violate privacy regulations
- How to improve Excel security
- Secure Excel alternative - Row Zero
Excel security risks
The primary security issues with Excel are related to how people use Excel, not the tool itself. In many organizations, typical Excel usage presents a security and data governance risk for several reasons:
Unauthorized access and data leakage - Without proper security measures, Excel files can be easily shared, copied, downloaded, emailed, and accessed by unauthorized users, leading to untraceable data leakage and potential data breaches, especially when stored on insecure devices or emailed as attachments.
Copy and paste - Copy and paste is very common in Excel and can quickly lead to sensitive data leaking externally, living in shadow files, and version sprawl.
Excel shadow IT - In many organizations, Excel spreadsheets are used for business-critical processes outside of the established IT infrastructure and without proper oversight. This can lead to operational and security risks with Excel spreadsheets in the org that are outside established data governance and security protocols.
Widespread usage and proliferation - Spreadsheets are widely used across teams, skill levels, and seniority levels. Due to their versatility, spreadsheets are used for a wide range of use cases and in unexpected ways. Spreadsheets also have a habit of turning into more spreadsheets, creating version control and data governance issues. As a result, it can be a challenge to manage Excel data governance and security.
Sensitive data originating in Excel - Many users type sensitive data into Excel directly, meaning Excel is the source of sensitive data entering the organization. For example, a sales or finance person may get a call or email from a customer and enter their data into an Excel spreadsheet. This can be problematic because that sensitive data may only live in Excel and not make it into a data warehouse, CRM, or data governance program that tracks customer data. This can create shadow customer data within an org, which can be a big security risk.
Legacy processes - Excel was released in 1985 and has been heavily used for decades. Many Excel users have outdated habits for how they use Excel spreadsheets and legacy processes that are not aligned to modern data governance best practices. Some potentially risky spreadsheet habits like emailing Excel attachments and saving Excel files locally are still widespread. The concept of file saving and sharing is somewhat antithetical to modern cloud data infrastructure, so Excel files sometimes live outside the cloud data governance ecosystem.
Macro viruses - Excel macros can be a security vulnerability. Attackers can embed malicious VBA scripts within Excel files to spread malware, steal data, or cause harm. This is why many organizations disable macros in their Excel security settings.
Excel phishing attacks: Cybercriminals may use phishing emails with infected Excel attachments to trick users into enabling macros and compromising their systems.
Excel encryption not default - A normal .XLSX file you save to your computer is not encrypted by default unless you turn on encryption (or your whole disk is encrypted). If you store the file in OneDrive/SharePoint, Microsoft encrypts the Excel file at rest in the cloud, but a copy you download is not encrypted unless you encrypt the file itself. View how to encrypt an Excel file below.
How Excel use may violate privacy regulations
Most privacy regulations like GDPR and HIPAA require organizations to:
- Track sensitive data in their org
- Prevent unauthorized access to sensitive data
- Delete customer data upon request
- Restrict unnecessary use of, or access to PII and PHI
- Enforce data lifecycle policies where sensitive data is deleted after its useful life
Without proactive management, training, and a strict Excel security and data governance program, Excel usage can violate privacy regulations if sensitive data is input, downloaded, copied, emailed, or shared in an Excel spreadsheet and is unable to be tracked and/or leads to unauthorized data access. For example, if a customer requests to delete their data but that data lives in an Excel file that was emailed as an attachment, it may be impossible to fully track down and delete that customer's data. Similarly, if an employee types sensitive data directly into Excel, it may not be fully tracked in the org's data governance program.
In general, best practice is to not use files when working with customer data. This is why a secure cloud spreadsheet like Row Zero can significantly improve data governance and security since you can connect your spreadsheets directly to your data warehouse, restrict data export, enforce row-level security, and enforce data residency and data lifecycle rules. With Row Zero, there are no files and data can be securely trapped in the cloud.
How to improve Excel security
While there are several potential security risks with Excel usage, there are steps you can take to make Excel more secure in your organization. Here are some Excel security best practices:
1. File-Level Protection:
While using files is generally not the best idea from a security standpoint, typical Excel usage means creating, saving, and sharing files. Here are steps you can take to make XLSX files more secure:
Share files via OneDrive/Sharepoint - If possible, use Microsoft 365 and share files via OneDrive/SharePoint to specific people, which will require sign-in to access the file. Files stored in Microsoft 365 cloud storage are encrypted at rest by default and encrypted in transit.
Encrypt Excel files - If you need the file itself to stay protected after it leaves the cloud (e.g., sent as an attachment or saved to a USB drive), use Excel’s file-level encryption. Here's how to encrypt an Excel file:
- Windows (Microsoft 365 / Excel 2016+):
- Open the Excel workbook.
- Go to File → Info → Protect Workbook → Encrypt with Password.
- Enter a strong password, confirm, and Save. From now on, the file can’t be opened without that password.
- Mac (Microsoft 365 / Office 2021+)
- Open the Excel workbook.
- Go to File → Passwords… → “Password to open” → set your password → OK, then Save.
For identity-based control that persists after download, use Sensitivity labels / Microsoft Purview Information Protection instead of a shared password. If you encrypt your Excel file with a password, be sure not to lose or forget the password, since it cannot be recovered.
- Windows (Microsoft 365 / Excel 2016+):
Password protect Excel files: Protect your Excel files with strong passwords to prevent unauthorized access. You can choose to require a password to open an Excel file or to modify it. The more secure version is to 'Encrypt with Password' as shown above. Note that “Protect Sheet/Workbook” (under the Review tab) is not encryption and just restricts modifications. Don’t rely on it for security or confidentiality.
Try not to share a password: Ideally, avoid sharing passwords by sharing the file with a specific person via OneDrive/SharePoint. If you must share a password:
- Use a password manager’s secure sharing feature (e.g., share an item from a shared vault). This gives you revoke/rotate options and avoids sharing via email/chat.
- If you can't do that, send it over an end-to-end encrypted channel like Signal or by voice. Don’t send it over unencrypted channels like regular email or SMS.
- Split channels: send the file via one channel and the password via a different channel.
- Use a different password per file.
Restricting Access: Use the "Restrict Access" feature to define specific permissions (e.g., read-only) for different users.
2. Worksheet-Level Protection:
In addition to file protection, you can use the "Protect Sheet" feature to restrict modifications to specific cells, ranges, or even the entire sheet. Navigate to the 'Review' tab and select 'Protect Sheet'. Here you can add a password and specify what actions users can perform while the sheet is protected, such as inserting, deleting, formatting, etc. 
3. Macro Security:
As mentioned above, macros can be a security vulnerability, so you'll want to set macro settings in Excel. You can manage macro settings via the Trust Center or by navigating to the Developer tab > Macro Security. Here you can disable or restrict macros and/or add trusted publishers to allow macros to run from those sources. 
4. External Content:
External data connections can pose a security risk and you can similarly configure Excel settings in Trust Center to control how Excel handles external content, such as prompts for data connections. 
5. General Security Practices:
There are several security best practices you can follow to support secure Excel usage in your organization.
- Train employees - Train employees on best practices for working with Excel. Even though most people are very comfortable using Excel, many would benefit from Excel security and governance training, especially if they'll be working with PII in Excel.
- Establish good habits - Establish a consistent naming convention for Excel files so that you can better manage them. Similarly, establish a habit for regularly deleting Excel files that contain sensitive data once you've completed your tasks. Regularly audit Excel files and Excel security settings to identify and address potential vulnerabilities.
- Be cautious with files - Only open files from trusted sources. Try to limit sharing files outside of OneDrive/SharePoint and try to limit putting sensitive data in Excel spreadsheets like PII.
- Establish an automated data lifecycle policy - Establish a program that automatically deletes files after a certain time period - for example, delete files that haven't been opened for one year.
- Establish thorough onboarding and offboarding - Ensure new employees get correctly set up and trained to securely work with Excel and other tools and data sources. Similarly, ensure files and access are appropriately handled when employees exit.
- Software updates - Keep your Microsoft Office suite updated to patch any Excel security vulnerabilities.
- Antivirus - Ensure your antivirus software is up-to-date to protect against malware attacks.
By implementing these data security measures, you can significantly improve Excel security in your organization. The key is to be aware of the potential risks and proactively develop a data governance and security strategy for your organization. Companies with large, sensitive datasets may also want to explore a more modern Excel alternative, like Row Zero, which is built for big data and modern cloud security, which we cover below.
Secure Excel Alternative - Row Zero
Row Zero is an enterprise-grade spreadsheet that was built to address the performance and security issues with typical spreadsheet usage. Row Zero works like Excel and Google Sheets but can handle 1000x bigger data sets, connects directly to your data warehouse, and brings modern cloud security to spreadsheets.
Here are some of Row Zero's enterprise security features:
- Cloud-based, no files - Row Zero is a hosted spreadsheet that runs in the cloud. While you can import files to Row Zero, Row Zero spreadsheets are accessed via secure login. There are no files. Your data never leaves the cloud.
- Single sign-on (SSO) - Spreadsheets can only be accessed via secure company login.
- Direct, secure connection to data sources - Users connect directly to the data warehouse to import data via SQL queries or self-serve data sources. You can eliminate ungoverned CSV downloads and locally stored files.
- Advanced access controls - Row Zero inherits row level security from the data warehouses via OAuth data connections. You can also set workbook access controls to view, edit, or share.
- Enforce data residency - Data never leaves a geographic region you set.
- Restrict data export - Optionally restrict export to CSV and restrict copy and paste.
- Restrict external sharing - Optionally prevent sharing outside your organization.
- HIPAA and SOC 2 compliant
Learn more about Row Zero's application and data security or request a demo to learn more.
Conclusion
Typical spreadsheet usage can be a security risk without proactive data governance. When sensitive data is typed into Excel, downloaded, copied, or shared it can lead to untraceable data leakage and make it challenging to delete customer data and comply with privacy regulations like GDPR and HIPAA. While many data teams try to transition users from Excel to BI tools and cloud SaaS tools, many end users ultimately want their data in a spreadsheet and will try to export data out of BI tools and CRMs to open in Excel. To solve these spreadsheet security issues, teams can develop robust Excel security and data governance programs to make Excel more secure for everyday use in their organization. Many organzations also look for secure Excel alternatives like Row Zero. Row Zero is a secure spreadsheet built for big data that solves the key spreadsheet security risks.