How to protect personal files on a work machine?

You cannot prevent spying if you use machines that you yourself don't administer. There is no way around that fact.
You can set up some little hurdles, but any admin with the intention to spy on you will easily overcome these.

For example: if you setup any kind of encryption, you will have to enter passwords - these passwords can be keylogged (=recorded) by admins.
And of course you would like to view and interact with your data - admins may silently record the screen and see everything you do and type.

So if you fear they will really be that nosey, don't use their machines with your data.

As the expert mentioned too, if you do not hold sole ownership to the encryption key, there is always a risk of exposure and leak. If you are going to store the data in the cloud, you need to safeguard your key and password. The device or machine storing these including the software  (like password mgr) need to be hold by you and known to you only. But in your case, it is not. Traces will be left.

Never leave your keys and password on machine that are not yours. Short of it is the IT department can still manage to see your data as long as the machine store it - you can never guarantee the client will not make a copy, download etc from the cloud drive. So probably it is not just encryption, the client once authenticated and authorised can do all the processing off their machine on the data that you set to grant them access.

Separate your really personal stuff from your consultant stuff.  Have 2, or more, separate Google drives, 1 that you never want someone else to see, and another with just the tools you need to access from client devices.  Have more accounts if you want to separate the clients.  It's the only way.

You have two challenges to deal with.

1) People snooping file names.

2) Data stored with Google, as they'll turn over your data to just about anyone who asks.

Here's how I deal with this.

1) Obfuscate file names including extensions, using a 16-32 hash (random alphanumeric string).

2) Encrypt these files with the openssl command line tool.

3) Keep an encrypted index with details of filename.ext which goes with each hash + details about how to decrypt each of these.

Be sure to keep this file encrypted.

You'll only go to these lengths for files containing things like passwords to all your other accounts.

If you go this route, no one will be willing to expend the money required to crack your files.

That's really tedious.

They just need a keylogger on a work system to grab your password as you type it in to open the file.  If you really worry about security, don't put it on the internet.  If you have to put it on the internet, then use a "zero knowledge" service like Spideroak.

If you have it in Google, you're not really that worried about security from google, but just want things online.  You just don't want random people accessing your files.  That's more easily done by having separate accounts as I've described.

Thanks everyone for their comments.  Here are some thoughts.

The data that I have falls into two buckets (a) Personal data - such as financial info.  Not required to do my job (b) Data from previous engagements which I use for my job.  

So I agree that one step is not to store personal files on my work computer... but would like to put some barriers against all the files.  Whilst I agree that an IT admin can install keyloggers and screen capture and then my data is compromised.  However this entails the IT Admins (a) going the extra mile and (b) make that step towards fraud etc.

So... what I am seeking is a solution that protect my data from an IT admin with simply standard access and not one taking steps to keylog and screen capture.   For example, and I am no expert.... can I use a standard encryption key from Microsoft, on a USB stick that I plug into the work machine when I want access to the files etc.

Thanks

A.

Yubikey works with google.  
https://www.yubico.com/

They're pretty pricey.
https://www.amazon.com/Yubico-FBA_Y-159-YubiKey-4-Nano/dp/B018Y1XXT6

I use the same approach that John outlines above and have done since the nineties.

If you don't want to go that way, and you are willing to accept the risk that the machine you are given is compromised (intentionally by the client IT people or by malware that they don't even know about), you might choose to just keep things on Google Drive as you are now.  To access it, requires your username (email address) and password, plus you can setup second factor authentication (highly recommended), using your phone (Android at least - not sure if Apple products would have that capability and / or if they will allow you to access Google Drive).

Now you are 'reasonably well protected' against most things, but you are still using a machine that is untrusted, so the risk is definitely still there, and if they give those machines to other consultants, and don't wipe them in between, then you are exposed to malware from other consultants who are careless or worse too.


Hope that helps,

Alan.

Traces and temp files are inevitable and forensic of the machine can get that out. Can you rely on the machine that is out of your control?

I am thinking of Encryption using a container file (like veracrypt) that need to be authenticated using a keyfile which is stored off machine. That container has all your sensitive files. That said, traces of keyfile if not securely wiped after use may still be traceable..

Simple answer is using your own machine and your own connection, as John and Alan have both mentioned. Ideally, you would also utilize your own connection for your laptop as well.

Another approach simply not to keep copies of clients' data, much less use them at other engagement. Rather, keep/utilize generic templates. Carrying those around poses no risk to other clients' information.

Ok.  I very much appreciate everyone's comments and feedback.  I have given this a lot of thought.... and here are my thoughts.

There is a categories of files, e.g. CV, personal training excel sheet - which is not uber secret and it would be useful to have on my 'clients' machine... but would like to put some security around it so that IT cannot see it.

The solutions that have been proposed mean a new computer and whilst I agree this is a bomb proof method....for some things a bomb proof solution is not required.  Building on this analogy....the windows in my car and house are not bomb proof!

So.... there must be a middle ground solution that doesn't involve password protecting each and every file individually....

thoughts?

So just place them on Google Drive (or similar) and be done with it.

'IT' would have to deliberately circumvent (hack, if you like that term) your setup to get to them.


Alan.