Slashdot Log In
How Do You Monitor Documents?
Posted by
samzenpus
on Thu Dec 25, 2008 07:57 AM
from the protect-yourself-at-all-times dept.
from the protect-yourself-at-all-times dept.
JumpDrive writes "I have been presented with a problem recently, which I know others have probably faced. During the last month, one of our customers accused us of providing another customer with their specification. So the question arose: how do we, or can we trace documents and find if they are being opened or used somewhere where they weren't intended. We don't want to be restrictive, because at times, we have people all over the place, but if one of our documents were opened in a foreign country, that would arouse suspicions. Most of our documents are made with MS office suite, and I have been thinking of working on a macro to ping a server, but that would require the user to enable the macros, and it would also require the insertion into about 1000 documents. But it's been difficult for me to find a solution that doesn't prevent someone in Omaha from opening a document for legitimate use and is not a solution that can easily be disabled or hacked around."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Microsoft Rights Management Server? (Score:5, Informative)
http://www.microsoft.com/windowsserver2003/technologies/rightsmgmt/default.mspx [microsoft.com]
Re: (Score:3, Informative)
Re: (Score:3, Funny)
Re:Microsoft Rights Management Server? (Score:5, Informative)
As does Oracle
Oracle Information Rights Management [oracle.com]
As does EMC, and a few others... Do shop around, as there are several products out there that can 'tether' assets - not just Microsoft Office documents too.
Parent
Other Options (Score:5, Informative)
EMC IRM [emc.com] (Formerly Authentica [slashdot.org] (yes, there is a typo in the summary))
Oracle IRM [oracle.com] (Formerly SealedMedia)
Liquid Machines [liquidmachines.com]
Adobe LifeCycle Rights Management [adobe.com]
Parent
Re: (Score:3, Informative)
Use GPG (GNU Privacy Guard). It's essentially PGP, but free. It uses assymetric encryption (Public and Private keys) up to 4096 bits of keylength, which is sufficient for most people. There are graphical frontends for Windows available, such as GPGee (shell extension).
If you encrypt a document using a customer's and your own public keys, only you and your customer can open it. It is extremely difficult (if not impossible) for other customers to open your documents. There's even support for digital signat
Re: (Score:3, Insightful)
yes, but once its open, it's open. and people are highly likely to open the archive, and keep the document unencrypted on their laptops.
here some form of document DRM could be a quite workable solution. I've been using Microsoft RMS as work as part of a pilot and while it has a few gotcha's, and while it does sometimes seem that MS just don't "get" how people use their software, it does seem to work.
the documents are encrypted within office apps (word, excel, outlook and powerpoint) and it has to authentica
Re: (Score:3, Insightful)
Scary thought to rely on Microsoft to solve this problem. I see quite a few other Microsoft pointers in the comments.
The problem seems to be what *people* do with the documents, not what the software does. Think sales person handing out brochures plus other informational material, sending emails with attachments etc.
The solution to this *people* problem is simply : policies + training.
Stephan
Re: (Score:3, Insightful)
The solution to this *people* problem is simply : policies + training.
I don't completely disagree with you, but I'd extend it to say "Policies + training + audit".
the microsoft solution, amongst others, provides a way to do this audit. it's not perfect, there are ways around the protection, but those ways rely on the person actively trying to get around the system. they know they are doing something wrong. these document DRM systems provide a framework so that the users can easily see what what they are sup
Not exactly (Score:5, Informative)
DRM is snake oil
DRM is snake oil in the way it's used to protect media from copy.
Because at the same time DRM is supposed to enable one to show the content (and thus give the key to the individual holding a copy) and exactly at the same time its supposed to stop unlicensed copies (thus preventing the exact same person using the exact same keys to copy the exact same media in a different way).
It's snake oil, because in the classical cryptographic triangle - A(lice) sending a crypted message to B(ob) without C(harles) snooping it - DRM makes B and C the exact same person.
Hence the contradiction, and hence DRM is doomed to eternally fail to protect media, no matter how contrived means are applied to it.
Here the reader ask a completely different question :
he wants A to be in the headquater, B to be an employee in Omaha, and C is some person doing industrial spying in Russia or China.
Some people are supposed to have the cryptographic keys to the documents, other people aren't supposed to have the keys.
In that circumstance, cryptography might help...
(Well, that's assuming that the thieve is an external person. Of course if that was an inside job, we're back at a situation that movies are in. But then the company has a much bigger problem of trust toward its employee to tackle first).
MS claims to do something which seems to be essentially *exactly* what you want
Well, the real problem is at the beginning of the sentence :
MS do something which seems to be essentially *exactly* what you want
Given their long history in term of computer security, you can count on MS to completely botch their solution...
Parent
Broken window vs. whole internet (Score:3, Insightful)
Furthermore, I'd argue that what makes locks effective is not the difficulty in opening them per se; most locks are actually not difficult to open. Heck in many cases all you need to do is break a window which could hardly be called difficult.
Also after breaking a window, one burglar has finally enough access only for himself, and he - alone - will be able to rob the house.
After breaking the DRM and managing to make 1 single unlicensed copy, thanks to the power of the internet suddenly everyone else in the world is instantly able to have access to this broken copy.
It is as if the same window broke on all houses of the same street and all the world's burglars where auto-magically teleported inside these houses to rob them at the same time.
Active Directory Rights Management Services (Score:5, Informative)
The best solution to your problem probably would be using Microsoft's AD RMS.
http://technet.microsoft.com/en-us/library/cc753531.aspx [microsoft.com]
AD RMS provides you with the ability to control licensing, opening, printing, etc. of documents. This will provide you with the audit trail you migh tneed.
Of course, you can still photograph every screen while scrolling through the pages, so it's essentially worthless in practice, but it might satisfy your customers demands for proper paperworks.
Yep, implementing AD RMS will be a heck a lot of work, and you'll surely need to adjust your internal processes in order to incorporate AD RMS.
What you're planning on doing is DRM: Which is, as all Slashdot readers know, impossible with a properly determined person. And in your case (industrial espionage), there are better people working on it than a few hackers that try cracking Blue-Ray in their spare time.
Re: (Score:3, Insightful)
".. And in your case (industrial espionage), there are better people working on it than a few hackers that try cracking Blue-Ray in their spare time.."
Alas...A good story, but I suspect there are very few industrial spies that are better at cracking DRM than the Blue-Ray hackers. Indeed, if there were any, DRM would be much harder to break.
And (and I speak from experience here), government has even less capabilityof clever cracking. It can throw a lot of money at a prpblem, but these problems are never solv
Re: (Score:2, Funny)
(Remember, the NSA is listening to you. Thanks, AT&T!)
If they were competent, they wouldn't have involved AT&T.
Re: (Score:2, Interesting)
The best solution to your problem probably would be using Microsoft's AD RMS.
Can this solution be used without an Active Directory environment?
There are plenty of organisations out there using other authentication, authorisation and trustee management mechanisms, just wondering what their options might be.
Re: (Score:2, Informative)
No.
No idea, sorry. Adobe also offers some DRM with their Adobe Acrobat / Acrobat Reader Suite, but the question specifically stated that they used MS Office, for which AD RMS probably is the best bet.
Re:Active Directory Rights Management Services (Score:5, Funny)
Can this solution be used without an Active Directory environment?
No. AD RMS, as the name implies, requires an Active Directory implementation. Microsoft is all about doing it one way -- The Microsoft Way. You obviously require re-education. Quick. Send in the consultants!
Parent
Re:Active Directory Rights Management Services (Score:5, Insightful)
The problem is: How can you prevent users with job responsibilities that require them to have access to the data for client A from sharing that (directly or indirectly) with client B. There really isn't a good way to do this, since in the worst case, the user can manually copy the material onto paper or take a picture with their cellphone.
Your best approach is a group of mitigation procedures that make it difficult for information to be intercepted between you and client A, and at least provide audit trail capability for users accessing confidential information.
The bad news is that you probably have no way to win client A's trust back. They've already made the accusation, and since you didn't have any pre-existing mechanism in place to monitor and prevent, you can't investigate their claims effectively. Also, if it turns out that employees of your company shared this information as a short-cut for supporting client B, you're really screwed in terms of legal responsibility and employee ethics. You'd have to fire both the source and the recipient in the data share, just for starters.
For the future: keep confidential documents in an encrypted content-management repository with user access and rights controls that can support segregation of groups, projects and so on. Have all your clients encrypt their data with your company's public key so that there is no MITM risk for items they are sending to you over the net (or Fedex for that matter). Institute a training program that emphasizes the segregation of projects for different clients (especially competitors) unless you are developing a project that is explicitly designed and marketed as a shared or commercial offering. And institute a security policy for your employees and contractors that identifies penalties including termination of employment, civil and criminal liability if data confidentiality policies are violated. You should probably also have a project "non-compete" clause where one person cannot work on projects for competing customers within 6 months of each other (or whatever timeframe is reasonable).
You may also want to look at the physical security of your facilities. If your people are leaving confidential documents in unlocked cabinets or leaving their PCs logged in, anyone with access to the office area (visitors, delivery people, cleaning service) could have taken the information.
Parent
RMS wouldn't help out (Score:4, Funny)
Parent
Re: (Score:3, Interesting)
"Worthless in practice" . . . not in my experience. Many leaks occur as people cut-and-paste or include more and more people in casual distribution ("Hey Joe, you might be interested in..."). Putting restrictions on a document helps this.
Security is a process, not a destination. Guarding against casual or thoughtless disclosure is a great mitigation; don't dismiss it because it doesn't solve the whole problem. No single thing will.
File Monitoring (Score:4, Informative)
You don't say what operating system you are running on the clients (I'm assuming windows of some variety), what network os you are using, or where the files are stored.
However, you want to turn on file access monitoring. It's pretty simple if you have one file server and all the files are there because you only have to turn it on once. Here's a good start:
http://www.microsoft.com/technet/security/guidance/serversecurity/tcg/tcgch03n.mspx
If you are running linux, http://www.rootprompt.org/article.php3?article=10751 was the second article in a google search.
Depending on the number of users and files, your logs can fill up quite quickly. You may also want something like SNARE http://www.intersectalliance.com/projects/index.html to monitor workstations. They may be doing some server work this morning; I'm getting a time out on the web page.
The bigger question though is if your clients think you are cheating them, why will they believe your logs?
You may also want to get some books on windows and linux security monitoring.
With a cabinet (Score:5, Funny)
I keep my sensitive documents in a locked cabinet. Never had an issue with a document opening itself in a foreign country.
Watermarks (Score:5, Interesting)
The watermark doesn't even have to be high tech, it can just be a guid inserted at some point in the document, with a company policy that says when you can remove it (never?), when you should change it (when it crosses a boundary, like a departmental boundary) and how records should be kept (e.g. a central database of which event caused the creation of a new guid).
DDRM is what you asked for, not monitoring (Score:3, Insightful)
DRM is broken by design.
Document DRM is even simpler to circumvent. Tiny cellphone/digital cameras. Screenshot much? Notepads? A really good memory is anti-ddrm. The best you can do is log access, but once it is accessed, there is no control over specifications. YMWNV.
Monitoring is exactly what he asked for (Score:3, Informative)
"how do we, or can we trace documents and find if they are being opened or used somewhere where they weren't intended?"
"if one of our documents were opened in a foreign country, that would arouse suspicions."
"Logging access" is exactly what he's trying to do. The idea here would be at least knowing, and if you've only given a document to one external entity, you know you have a leak somewhere within that entity or your own organization. Simple managed watermarking can help to discover which.
And DRM in gener
embed (Score:2)
Don't know how many document formats support it, but perhaps you could have an embedded image or other embedded information pointing at a file on a web server. All accesses would then be recorded on the server log.
Re: (Score:2)
There is no solution (Score:2)
What you are trying to do is what DRM has been trying to do for a long time: prevent unauthorised people opening a document on untrusted hardware.
The reason all DRM ultimately fails is because the system opening the document is untrusted. You simply can't have easy access outside your company with the ability to do things like print and prevent unauthorised copying, the two are mutually exclusive.
There are systems which do what you are asking, but they all rely on only trying to open the document within you
Use Sharepoint (Score:2, Informative)
Sharepoint is your best bet here.
The only alternative I can think of is checking your docs into your source control.
DLP (Score:2)
Protection of data is hard. There are many variables to consider.
The first step to understanding what data that requires protection is to perform a risk assessment. This will help identify information which may result in financial loss, corporate brand confidence in the event that the data is compromised.
It's important that this task has senior management sponsorship. Getting a sysadmin to "get on with it" is not good enough. It needs input from the business to understand the information that needs protecti
NTFS auditing (Score:2)
You can't (Score:5, Insightful)
That is the simple answer.
If you want to give something to someone, you can't control what they do with it. That is like saying "I want to give this hammer to a friend, but I want to prevent them from loaning it to someone else, or using it to smash computers with."
If you don't trust the person that you give something, then the chain of trust is broken. Everything we do is based on trust. I trust if I give you an emergency key to my house that you won't rob me. I trust that when I accept cash from you to pay for a service that it isn't counterfeit. I trust when you sign a contract with me, you will live up to your duties in the contract. I trust when you babysit my children you won't rape them. You pretty much asked for exactly what the whole point (and failure) of DRM is all about- trying to FORCE *everyone* to trust and comply with your wishes. You can't. Welcome to humanity.
Re: (Score:2)
You can't eliminate the chance of a fatal car accident unless you never go near a road or get in a vehicle, but that doesn't mean wearing a seat belt is a waste of time.
contract signing (Score:2)
actually says I don't 'trust you when you shake my hand- but if we get a third party (or more involved) then I'll trust you'
Impossible (Score:5, Insightful)
No, you can't. If you want people to be able to read it, they can copy it. You can make it more cumbersome but nothing can prevent screenshots. You can waste a lot of time and money, but the best you will achieve is being able to say "we tried". Because you cannot succeed. You can't distribute a document and at the same time expect it to remain secret.
Re: (Score:3, Interesting)
Adobe (Score:2)
At my workplace we handle standards and manufacturing procedures for a variety of companies worldwide. We don't lock our documents but we do use adobe PDF's so we can track who accesses. They state that it's basically not feasible to be able to prevent access to something unless you were to grant it remotely in the first place (similar to like a view-only google doc) instead of giving a document to your customer. Meanwhile, this could still be screencapped if someone wanted their own copy, so it's not even
Interwoven DMS (Score:2)
Depending on your budget, there may be some value in looking into the "Interwoven" Document Management System (DMS)..
Its primarily marketed to legal firms, however its got great file tracking (i.e. who, where, when opened, printed, viewed, and for how long.. etc..) and is quite well rounded to suite the needs of just about anyone.
Has no Linux suport for the server or desktop clients though...
microsoft advertising? (Score:2, Insightful)
This ask slashdot seems a little suspicious to me, it does seem to exactly match the feature set of a suite of microsoft products.
Anyone worth thair salt as a system administrator that works with microsoft tools should know the features of microsoft office and the add on server components to get the DRM system working in an enterprise.
It sounds suprisingly close to what you would find in a microsoft pamphlet.
What's the real problem here? (Score:5, Informative)
OK, you've gone for a tech solution to a problem before really asking what the problem here is. So what's the real problem? Legal libility, of course. Your customer X is accusing you of sharing data with their competition Y.
Create an job to track sensitive documents. If you only have a few, then it would be additional duties for someone. If you have a lot, it's a new position. This job is to track who has legitimate access to sensitive documents. When customer X starts throwing allogations you've shared data with customer Y, everyone that has legitimate access to the data is required to sign an affidavit that they did not share the data with people not autorized to have the info. Now customer X has to PROVE that one of your employee's did indeed do so, and that their affidavit is a lie. MUCH harder to prove and a lot cheaper for your company to defend against.
Of course, that won't stop customer X from THINKING you did, and that may cost you that customer, but absent using a full up sensitive document control system like the government does, there's no real inexpensive solution I've found. I'd be interested to see if /. comes up with one though.
Welcome to Multi-Level Security (Score:3, Insightful)
First, though, if you don't have a document handling and marking policy for PAPER documents, you're unlikely to succeed implementing one for electronic documents. In other words, if you don't presently mark printed documents with restrictive handling requirements ('secret', 'confidential', 'proprietary', 'atty-client privileged'), it won't do you any good to try to control their electronic versions.
Second, Windows has never been designed to try to enforce more than discretionary controls. What does that mean? It means that EVERYONE who touches the machine or its data is presumed to be cleared to see whatever is on the machine. They may not have the need to know what's there (that's what DAC does), but they're cleared to see it - so they're TRUSTED to handle it correctly.
If that doesn't describe your environment, you should reconsider whether a single-level system, like Windows, is suitable for storing, printing and using your documents in your environment.
Microsoft Sharepoint (Score:2, Insightful)
Usable documents? (Score:2)
You can agree there is no use to copy/paste portions of your documents, no need to use them under any other platform than windows, but printing?
The problem will end being in how many ways you will penalize the rightful users of those documents to avoid someone else to access
You Need More than a Software Solution (Score:3, Insightful)
Coming In Sideways (Score:3, Interesting)
Let's say that up until now you haven't had the ability to monitor documents to the extent specified. You can't prove whether or not the leak occurred from within your domain. Neither can they: they don't have the ability either, or you'd know. So, neither can they can't disprove your (forthcoming) assertion that the leak came from within their domain, and you can't support it. But as we can see commonly happen, accusations carry more weight than mere questions, rightly or wrongly. Accusing them will wake them up and put you on even footing. From then on you can develop a mutually acceptable and workable security system.
It'll have to be rigorous, as in enlisting the OS to assist. Otherwise one could simply copy the file and open it outside a secured domain. And that too will take oversight, by one such as a security admin who'll be able to track the file's circulation including any instances of it being copied. Note that opening for editing constitutes an explicit copy until (at least) the changes are saved, which would show up, and copying the data from memory to a swap file would constitute an implicit copy that wouldn't normally get reported. It could, however, be used to grab a copy (of a copy) of the file just as we used to use a browser's cache for grabbing copies of streamed media that weren't otherwise easily snagged.
Of course you could use the information above to show they can't support their assertion and so you could sue them for defamation. Better, you could give them the choice of that or joining you in investigating the security problems and solutions, and possibly investigating the competitor for espionage. Once again, accusations can carry a lot of weight. But then the competitor might be willing to join the investigation in order to be able to track their own as well as (as could everyone) prove that any infringements didn't come from their domain. The best security comes when all are watchers and all watch each other in the open.
Use Google Docs (Score:4, Funny)
The simple solution is to use google docs and tie your documents to google analytics.
Re:Document control (Score:5, Insightful)
You have completely missed the point of Ask Slashdot. It's just not about doing a 5 minute search and randomly choosing one. The reason people ask this group questions like this is because they want more detailed information from people who have hopefully had hands on experience doing these things. What worked? What didn't? Why did it, or did not work? How was implemented? You may not be able to find that kind of information easily even if you know what to search for. And once you have that information, there are other people to give their insights on what that persons stories. It has the potential to be one big chain of helpfulness.
Sure, it's a cheap and lazy way of getting someone else to do some of your work for you, but it's not generally a bad thing. I know if I was completely clueless about some tech related problem, I'd probably ask here. Wouldn't you?
Parent
Re: (Score:2)
But what you didn't explicitly mention, you seem to take it for granted, is that all systems at some point have to rely on trust.
So the issue at hand is best, if not only, tackled at the HR and/or PO department, more technology has little effect.
Re: (Score:3, Informative)
Re:Google Apps? (Score:5, Interesting)
Copy/paste is disabled? The ability to take local screen caps? The ability to make notes with a pen and paper?
For documents that really, truely need to be tracked, you use a canary trap. That is, each copy is slightly and uniquely different. Each copy is receipted by a specific person. If you find a copy in the wild, you can find a key phrase and track down who leaked it.
Parent