Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 8 down vote favorite
1

An organization I am consulting for is trying to find a DRM solution for an ebook that they publish internally. It is in pdf format.

Does anybody have experience with DRM for pdfs, and if so, any suggestions?

share|improve this question
4  
Can you talk some more about the threat model? There are so many tradeoffs for this generically "impossible" problem that it is important to know what the organization is really concerned about. – nealmcb Dec 14 '10 at 22:02
@nealmcb Good question: the ebook is a set of technological procedures that could be very useful outside of the org. Employees will be taking it with them internationally to other countries as part of their work, and the org is more concerned with them sharing it with co-workers of other orgs, etc, than with other orgs "hacking" in and taking the ebook. Hope that helps. – Josh Brower Dec 14 '10 at 23:13
1  
Why does the org wish these useful procedures not to be shared? Ceteris paribus, it seems that they should be shared. – Zack Dec 15 '10 at 20:26
@Zack I cannot comment on that--I am but the consultant. – Josh Brower Dec 16 '10 at 12:17
1  
I only mean to suggest that this is a question you should be asking your client. – Zack Dec 16 '10 at 17:43
show 1 more comment

2 Answers

up vote 12 down vote accepted

In order of inconvenience:

  • policy. Just tell internal users not to publish internal documents. If you can't do that, your problems are worse than leaky text. Whistleblowing, espionage and many other forms of data exfiltration are fundamentally HR issues.
  • password-protected PDF. Not much of a blocker but enough to put off accidental discovery should the files get leaked.
  • Adobe Content Server. Throw Adobe some dollars (quite a few dollars, actually) and they'll make it a bit harder to copy the PDFs using their DRM wrapper.

If you do all that and ban writable media, network connections, cameras, printers and pens from the environment, then there's only the employees' memory to contend with :-).

share|improve this answer
Don't forget phones and voice recorders... – AviD♦ Dec 15 '10 at 10:42
up vote 3 down vote

Have a physically secured kiosk at which people can read the pdf, after they're searched for cameras? All a software pdf DRM solution will do is marginally increase the difficulty of copying the material, and there's always trade-offs.

If you go with a standalone reader that needs to be installed on every device that reads the ebook, you'll have to face the configuration management headache and expense. If you go with a smaller-footprint password-protection scheme, you'll have no protection against even so trivial a circumvention as the "Print Screen" button.

It all depends on how badly the customer wants to secure the document; but a better approach might be securing the people reading it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.