How Do You Monitor Documents? 237
JumpDrive writes "I have been presented with a problem recently, which I know others have probably faced. During the last month, one of our customers accused us of providing another customer with their specification. So the question arose: how do we, or can we trace documents and find if they are being opened or used somewhere where they weren't intended. We don't want to be restrictive, because at times, we have people all over the place, but if one of our documents were opened in a foreign country, that would arouse suspicions. Most of our documents are made with MS office suite, and I have been thinking of working on a macro to ping a server, but that would require the user to enable the macros, and it would also require the insertion into about 1000 documents. But it's been difficult for me to find a solution that doesn't prevent someone in Omaha from opening a document for legitimate use and is not a solution that can easily be disabled or hacked around."
Microsoft Rights Management Server? (Score:5, Informative)
http://www.microsoft.com/windowsserver2003/technologies/rightsmgmt/default.mspx [microsoft.com]
Active Directory Rights Management Services (Score:5, Informative)
The best solution to your problem probably would be using Microsoft's AD RMS.
http://technet.microsoft.com/en-us/library/cc753531.aspx [microsoft.com]
AD RMS provides you with the ability to control licensing, opening, printing, etc. of documents. This will provide you with the audit trail you migh tneed.
Of course, you can still photograph every screen while scrolling through the pages, so it's essentially worthless in practice, but it might satisfy your customers demands for proper paperworks.
Yep, implementing AD RMS will be a heck a lot of work, and you'll surely need to adjust your internal processes in order to incorporate AD RMS.
What you're planning on doing is DRM: Which is, as all Slashdot readers know, impossible with a properly determined person. And in your case (industrial espionage), there are better people working on it than a few hackers that try cracking Blue-Ray in their spare time.
File Monitoring (Score:4, Informative)
You don't say what operating system you are running on the clients (I'm assuming windows of some variety), what network os you are using, or where the files are stored.
However, you want to turn on file access monitoring. It's pretty simple if you have one file server and all the files are there because you only have to turn it on once. Here's a good start:
http://www.microsoft.com/technet/security/guidance/serversecurity/tcg/tcgch03n.mspx
If you are running linux, http://www.rootprompt.org/article.php3?article=10751 was the second article in a google search.
Depending on the number of users and files, your logs can fill up quite quickly. You may also want something like SNARE http://www.intersectalliance.com/projects/index.html to monitor workstations. They may be doing some server work this morning; I'm getting a time out on the web page.
The bigger question though is if your clients think you are cheating them, why will they believe your logs?
You may also want to get some books on windows and linux security monitoring.
Re:Active Directory Rights Management Services (Score:2, Informative)
No.
No idea, sorry. Adobe also offers some DRM with their Adobe Acrobat / Acrobat Reader Suite, but the question specifically stated that they used MS Office, for which AD RMS probably is the best bet.
Use Sharepoint (Score:2, Informative)
Sharepoint is your best bet here.
The only alternative I can think of is checking your docs into your source control.
Monitoring is exactly what he asked for (Score:3, Informative)
"how do we, or can we trace documents and find if they are being opened or used somewhere where they weren't intended?"
"if one of our documents were opened in a foreign country, that would arouse suspicions."
"Logging access" is exactly what he's trying to do. The idea here would be at least knowing, and if you've only given a document to one external entity, you know you have a leak somewhere within that entity or your own organization. Simple managed watermarking can help to discover which.
And DRM in general may be broken, but it's not that black and white: DRM does prevent some casual theft of content, because it's a hassle...that's all anyone with a brain -- and who has paid attention to anything in digital media for the last decade and still employs DRM -- expects anymore.
Those who which to pirate content will ALWAYS be able to do so, regardless of any protections put in place. Perhaps someday those who favor DRM will realize that the losses from hassle to honest customers or prospective customers outweighs anything "gained" from having DRM in place.
But back to the issue at hand, which is a different one: an organization wants to track -- and potentially prevent, under some circumstances -- access to original documents representing proprietary data. A "DRM" model (like that employed by Microsoft Rights Management Server [microsoft.com]) can help to accomplish this. Of course, once someone discovers it's in place, then any number of untrackable circumvention options, such as those you mentioned, can easily be employed. So, the best option for this case is passive tracking/logging.
What's the real problem here? (Score:5, Informative)
OK, you've gone for a tech solution to a problem before really asking what the problem here is. So what's the real problem? Legal libility, of course. Your customer X is accusing you of sharing data with their competition Y.
Create an job to track sensitive documents. If you only have a few, then it would be additional duties for someone. If you have a lot, it's a new position. This job is to track who has legitimate access to sensitive documents. When customer X starts throwing allogations you've shared data with customer Y, everyone that has legitimate access to the data is required to sign an affidavit that they did not share the data with people not autorized to have the info. Now customer X has to PROVE that one of your employee's did indeed do so, and that their affidavit is a lie. MUCH harder to prove and a lot cheaper for your company to defend against.
Of course, that won't stop customer X from THINKING you did, and that may cost you that customer, but absent using a full up sensitive document control system like the government does, there's no real inexpensive solution I've found. I'd be interested to see if /. comes up with one though.
DRM is snake oil (Score:1, Informative)
MS claims to do something which seems to be essentially *exactly* what you want
There, fixed that for you...
Re:Microsoft Rights Management Server? (Score:3, Informative)
Re:Microsoft Rights Management Server? (Score:5, Informative)
As does Oracle
Oracle Information Rights Management [oracle.com]
As does EMC, and a few others... Do shop around, as there are several products out there that can 'tether' assets - not just Microsoft Office documents too.
Other Options (Score:5, Informative)
EMC IRM [emc.com] (Formerly Authentica [slashdot.org] (yes, there is a typo in the summary))
Oracle IRM [oracle.com] (Formerly SealedMedia)
Liquid Machines [liquidmachines.com]
Adobe LifeCycle Rights Management [adobe.com]
Re:Hummingbird DM5. (Score:3, Informative)
Re:Microsoft Rights Management Server? (Score:3, Informative)
Use GPG (GNU Privacy Guard). It's essentially PGP, but free. It uses assymetric encryption (Public and Private keys) up to 4096 bits of keylength, which is sufficient for most people. There are graphical frontends for Windows available, such as GPGee (shell extension).
If you encrypt a document using a customer's and your own public keys, only you and your customer can open it. It is extremely difficult (if not impossible) for other customers to open your documents. There's even support for digital signatures.
Not exactly (Score:5, Informative)
DRM is snake oil
DRM is snake oil in the way it's used to protect media from copy.
Because at the same time DRM is supposed to enable one to show the content (and thus give the key to the individual holding a copy) and exactly at the same time its supposed to stop unlicensed copies (thus preventing the exact same person using the exact same keys to copy the exact same media in a different way).
It's snake oil, because in the classical cryptographic triangle - A(lice) sending a crypted message to B(ob) without C(harles) snooping it - DRM makes B and C the exact same person.
Hence the contradiction, and hence DRM is doomed to eternally fail to protect media, no matter how contrived means are applied to it.
Here the reader ask a completely different question :
he wants A to be in the headquater, B to be an employee in Omaha, and C is some person doing industrial spying in Russia or China.
Some people are supposed to have the cryptographic keys to the documents, other people aren't supposed to have the keys.
In that circumstance, cryptography might help...
(Well, that's assuming that the thieve is an external person. Of course if that was an inside job, we're back at a situation that movies are in. But then the company has a much bigger problem of trust toward its employee to tackle first).
MS claims to do something which seems to be essentially *exactly* what you want
Well, the real problem is at the beginning of the sentence :
MS do something which seems to be essentially *exactly* what you want
Given their long history in term of computer security, you can count on MS to completely botch their solution...
Re:Watermarks (Score:2, Informative)
You mean stenanography. The GP is using a watermark (watermarks are imprinted in a medium to determine where something came from). A watermark can be easily visible without hiding information. In fact, most sites use watermarks in images to prevent hotlinking and taking credit for the image.