In most cases, information is what separates market leaders in any category from other market players. Unfortunately, a lot of people know this and will always be on the lookout for what makes a company or its products so special.
While company employees are tasked with guarding that information, their main motivation for being there is earning money in the form of a paycheck at the end of each month. However, if a rival company were to approach them and offer them more money for the trade secrets of their current employer, it would be quite tempting to accept the proposal.
This just goes to show that, whenever documents are leaked, there is almost always an inside man. In essence, the most dangerous people to document security are those given access and control.
While the above example may not always be the case, there are quite a number of scenarios where information falling into the wrong hands would lead to dire consequences. As a result, in the past few years, people have tried to enhance document security in a bid to prevent leaks. These efforts have not always born the best fruits.
First, there was encryption to protect documents in storage and transit. Of course, encryption had some issues as there was no way to regulate what the users did with a file once they had decrypted it. They could make an unencrypted copy and send it out wherever they wished. Consequently, encryption was not viable in the long run for sharing documents securely.
Enterprise access controls were also used. However, users could copy sensitive documents on to their phones and walk right out of the company doors with them. And, you cannot stop people from bringing their own devices to work. It may work with computers, but it is rarely an option with mobile devices. So, such controls were too limited.
Then Digital Rights Management (DRM) controls were applied. People who use encryption or enterprise access controls may be skeptical about DRM as the other methods also promised the world and did not deliver. But, let us see how DRM stacks up in comparison with those methods that came before it.
DRM still encrypt files as its first security method and then applies access controls as its second method. The third method used in a document DRM system is licensing controls. So, it has the functionality of the previous methods built in with additional security controls. But, only the authorized party has access to documents because documents are locked to individual devices and content is only ever decrypted in memory. In this way, once the file is decrypted, the authorized user is limited in terms of what he or she can do with the document.
In addition, DRM will not allow the copying of files to other devices, including mobile devices, flash drives, and all other storage devices. Essentially, the ability to determine which types of devices can access a certain file or group of files.
Of course, the authorized users may sometimes need to print a copy. However, too many printed copies are difficult to control. So, DRM controls will let the system admin define the number of copies a user is allowed. In this way, each printed copy can be accounted for. It is also possible to set the number of prints at none and, therefore, prevent the creation of any paper copy of a document.
Having an idea of how many times an authorized party uses a document and where they used it may also be used as a basis to detect suspicious behavior. If something does not feel right, the user’s access can be instantly revoked to prevent a potential breach until it can be ascertained that there was no malicious intent. You may also need to revoke access for other reasons. For example, you could revoke access to a person who no longer works at a company or revoke access when a document has outlived its usefulness. Whatever the reason, this feature is nice to have.
DRM can also be used to prevent screen grabbing and to apply dynamic watermarks with user information displayed at view/print time to discourage photos or photocopies being taken.
With all these controls, can DRM be termed a viable option to stop documents from being leaked? One thing is for sure, it does significantly reduce the possibility of an inside person being the source of a leak. Whether or not that will be enough to prevent leaks from ever happening remains to be seen. However, the fact that it is the most effective document security protocol at the moment cannot be disputed.