9

An organization I am consulting for is trying to find a DRM solution for an ebook that they publish internally. It is in pdf format.

Does anybody have experience with DRM for pdfs, and if so, any suggestions?

Scott Pack
  • 15,297
  • 6
  • 63
  • 91
Josh Brower
  • 1,387
  • 2
  • 13
  • 25
  • 4
    Can you talk some more about the threat model? There are so many tradeoffs for this generically "impossible" problem that it is important to know what the organization is really concerned about. – nealmcb Dec 14 '10 at 22:02
  • @nealmcb Good question: the ebook is a set of technological procedures that could be very useful outside of the org. Employees will be taking it with them internationally to other countries as part of their work, and the org is more concerned with them sharing it with co-workers of other orgs, etc, than with other orgs "hacking" in and taking the ebook. Hope that helps. – Josh Brower Dec 14 '10 at 23:13
  • 1
    Why does the org wish these useful procedures not to be shared? Ceteris paribus, it seems that they should be shared. – zwol Dec 15 '10 at 20:26
  • @Zack I cannot comment on that--I am but the consultant. – Josh Brower Dec 16 '10 at 12:17
  • 1
    I only mean to suggest that this is a question you should be asking your client. – zwol Dec 16 '10 at 17:43
  • @Zack I understand, and I appreciate the thought--I can tell you right now that for better or worse, that is not an option. Hence, my DRM question. – Josh Brower Dec 16 '10 at 20:34

2 Answers2

12

In order of inconvenience:

  • policy. Just tell internal users not to publish internal documents. If you can't do that, your problems are worse than leaky text. Whistleblowing, espionage and many other forms of data exfiltration are fundamentally HR issues.
  • password-protected PDF. Not much of a blocker but enough to put off accidental discovery should the files get leaked.
  • Adobe Content Server. Throw Adobe some dollars (quite a few dollars, actually) and they'll make it a bit harder to copy the PDFs using their DRM wrapper.

If you do all that and ban writable media, network connections, cameras, printers and pens from the environment, then there's only the employees' memory to contend with :-).

3

Have a physically secured kiosk at which people can read the pdf, after they're searched for cameras? All a software pdf DRM solution will do is marginally increase the difficulty of copying the material, and there's always trade-offs.

If you go with a standalone reader that needs to be installed on every device that reads the ebook, you'll have to face the configuration management headache and expense. If you go with a smaller-footprint password-protection scheme, you'll have no protection against even so trivial a circumvention as the "Print Screen" button.

It all depends on how badly the customer wants to secure the document; but a better approach might be securing the people reading it.

user502
  • 3,311
  • 1
  • 24
  • 18