Security has become one of the primary concerns when an organization connects its private network to the Internet. Regardless of the business, an increasing number of users on private networks are demanding access to Internet services such as the World Wide Web (WWW), Internet mail, Telnet, and File Transfer Protocol (FTP). In addition, corporations want to offer WWW home pages and FTP servers for public access on the Internet.
Security Management of IT
Security has become one of the primary concerns
when an organization connects its private network to the Internet. Regardless
of the business, an increasing number of users on private networks are
demanding access to Internet services such as the World Wide Web (WWW),
Internet mail, Telnet, and File Transfer Protocol (FTP). In addition,
corporations want to offer WWW home pages and FTP servers for public access on
the Internet.
Network administrators have increasing concerns
about the security of their networks when they expose their organization’s
private data and networking infrastructure to Internet crackers.
Document Security – means to secure users
documents
When we talk about document security we can
have many different ideas as to what security is actually wanted or needed, and
what it is there to achieve. Let’s look at the three principal approaches used
today, how they rely upon each other and where they differ. The principal
approaches are encryption, DRM and collaboration.
Encryption
Underpinning all digital security systems is
encryption. If prospective document security solution does not use this, then
forget it because it is just smoke and mirrors. Encryption is the technology
that hides documents from those who are not authorized, and verifies that the
content the originator created is unchanged.
If one is authorized recipient of encrypted
information they have the ability to do anything like with that information
once you have removed the encryption. That is the Achilles’ heel. The recipient
of documents that have been encrypted can go on to use them in any way they
wish, and to alter them in any way they wish.
That does not mean they can pretend that
someone else originated them. And that is a valuable protection, provided the
user can be bothered to look closely at the authenticity of documents received.
Encryption therefore is just the building block
of document security but has limited controls
DRM –
Digital Rights Management
DRM looks to take care of continuing control(s)
over information. Whether it’s a song, film or a book, DRM uses and then goes
beyond the capabilities of pure encryption in enforcing persistent controls
over the ability to use the content. It is used to limit the ability to
distribute (Copyright being the right to make copies and distribute!) or to print,
or to view.
Historically, DRM has been used when one entity
wants to grant access to its information to another entity, but under
controlled conditions. This can be for making sure employees cannot take key
documents with them if they leave, or that those who have bought a book, or a
training course, cannot pass it on to anyone else without the publisher’s
permission (and, no doubt, a fee).
The combination of digital rights management
controls and encryption ensure documents cannot be shared with others, copied,
modified or printed. The use of copy and paste and screen grabbing is usually
prevented (depending on the vendor).
If user is looking therefore for complete
control over their document security then a solution using digital rights
management is what they need to purchase.
Collaboration
Collaboration is an important aspect of
document security where document modification is required. Often it does not
make use of encryption technology, but relies on access control mechanisms to
identify who authorized users are, and to link those identities to the input
they made to a specific document.
As one can guess, collaboration is really a
precursor activity to DRM. The controls for collaboration are focused over
making sure corporate administrators can be certain that only authorized
persons had access to and could (or did) amend the document, and that it is
properly authorized for distribution. The document that is distributed will
appear to be a finished item, and none of the internal management matters will
be made available to anyone, either internally or externally. The ability to
prevent the use of simple cut and paste or screen grabbing is usually not
implemented.