See the official online handbook for more information about securing private files. The information about private files starts at the "Managing file locations and access" header.

Drupal provides configuration settings to control whether, and how, users and administrators can upload files for use by Drupal.