0

I got a strange requirement as part of a recent project that our company is involved with. The project involves sensitive information and hence the data is restricted to only the team members involved in the project. We have a network share, and the NTFS and Share permissions have been secured to allow only the members of an active directory security group (this security group has all the project members). The members of this security group can Create / Modify / Delete files & subfolders inside the folder. The real requirement now is to stop these users from doing the following activities.

  1. Copy the files from this folder or subfolders to another location
  2. Restrict users from opening the word document (or any other type of document), use 'Save As' function to save it to a different location
  3. Open the word document (or any other type of document), copy the contents to a new document

Is there a way of achieving this requirement? Any help / guidance towards achieving this is fine. I can research more on that and come to a conclusion. Thanks for your suggestions / help on this.

  • 4
    Generally if someone can read data, they can copy said data. You can make it hard to use existing OS functions to do that, but in the end, there's nothing stopping someone from taking a photo of the screen and saving the photo in another folder. – forest Dec 20 '18 at 2:45
  • If you want proper DRM, you should use proper DRM, not try to fake it with Windows permissions, which are no where near capable of the desired outcome. – Don Simon Dec 20 '18 at 21:20
2

When someone can read data they can also copy it. Preventing copying and/or distribution of data is an age old problem in the entertainment good industry. Data such as movies and games are protected via DRM (Digital Right Management).

If the project members look at the data from their work computer then it doesn't matter how well-secured the folder or the document editor is. They would still be able to use a phone camera to record their screen and/or use pen and paper to copy the information. Similar to how you can copy a copy-protected movie by recording your TV with a camera or video recorder. They might be able to remember the more interesting parts of the document which is also a kind of copy. Similar to hoe you don't need pen and paper in order to spoil your friends about a movie plot twist.

We could have a separate secured room which is guarded like a previous answer stated. But I assume this is too expensive and/or unpractical for your use case.

Your best option is to enforce the copy-protection via contracts instead of using expensive physical means. Let the people of the project sign a non-disclosure agreement.

(Please notice how I use "movie" as a consumer-grade anology to showcase that digital means of static content copy prevention only has marginal to none effect)

|improve this answer|||||
1

The common way is not technical but social. The person entitled to use the restricted information must sign a document in which they say that they know that the informations shall not be copied outside of the secured server and that they understand that doing it would expose them to legal actions.

It is more or less: if you do not want something but cannot prevent it, just forbid it.

|improve this answer|||||
0

The only real way to achieve this is to set up separate computers, in a secure room, and prohibit taking cell phones into this room.

Disable WiFi, use cabled ethernet, and disable USB. Give the users limited accounts.

That is the only way you can have reasonable chances of keeping it secret. Everything else may protect against inadvertent disclosure, but not an insider wanting to copy, either out of convenience or malice.

|improve this answer|||||
  • 1
    Not to mention that the developers might carry a copy of the information inside their head out of the room – BlueWizard Dec 20 '18 at 7:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.