Prevent users from copying sensitive data

Question

I got a strange requirement as part of a recent project that our company is involved with. The project involves sensitive information and hence the data is restricted to only the team members involved in the project. We have a network share, and the NTFS and Share permissions have been secured to allow only the members of an active directory security group (this security group has all the project members). The members of this security group can Create / Modify / Delete files & subfolders inside the folder. The real requirement now is to stop these users from doing the following activities.

1. Copy the files from this folder or subfolders to another location
2. Restrict users from opening the word document (or any other type of document), use 'Save As' function to save it to a different location
3. Open the word document (or any other type of document), copy the contents to a new document

Is there a way of achieving this requirement? Any help / guidance towards achieving this is fine. I can research more on that and come to a conclusion. Thanks for your suggestions / help on this.

Answer 1

When someone can read data they can also copy it. Preventing copying and/or distribution of data is an age old problem in the entertainment good industry. Data such as movies and games are protected via DRM (Digital Right Management).

If the project members look at the data from their work computer then it doesn't matter how well-secured the folder or the document editor is. They would still be able to use a phone camera to record their screen and/or use pen and paper to copy the information. Similar to how you can copy a copy-protected movie by recording your TV with a camera or video recorder. They might be able to remember the more interesting parts of the document which is also a kind of copy. Similar to hoe you don't need pen and paper in order to spoil your friends about a movie plot twist.

We could have a separate secured room which is guarded like a previous answer stated. But I assume this is too expensive and/or unpractical for your use case.

Your best option is to enforce the copy-protection via contracts instead of using expensive physical means. Let the people of the project sign a non-disclosure agreement.

_{(Please notice how I use "movie" as a consumer-grade anology to showcase that digital means of static content copy prevention only has marginal to none effect)}

Answer 2

The common way is not technical but social. The person entitled to use the restricted information must sign a document in which they say that they know that the informations shall not be copied outside of the secured server and that they understand that doing it would expose them to legal actions.

It is more or less: if you do not want something but cannot prevent it, just forbid it.

Answer 3

The only real way to achieve this is to set up separate computers, in a secure room, and prohibit taking cell phones into this room.

Disable WiFi, use cabled ethernet, and disable USB. Give the users limited accounts.

That is the only way you can have reasonable chances of keeping it secret. Everything else may protect against inadvertent disclosure, but not an insider wanting to copy, either out of convenience or malice.