Using Dynamic Watermarks to Protect Documents

How to add a Dynamic Watermark to a Document that is permanent or non-removable

What dynamic watermarks are, why they are important, and what you need to think about when choosing a solution to apply them with.

Document watermarking is hardly a new concept.  The oldest watermarks, created by embedding wire or varying paper thickness, were found as early as the 13th century.  The digital medium, however, has delivered a paradigm shift for watermarks, with the majority of them not seen on the page, but rather as pixels on a screen or code in a file.

Perhaps one of the biggest benefits of a digital watermark is the fact that it no longer needs to be static.  Through the use of dynamic watermarking, publishers can create watermarks that are far more effective and useful.

   What is dynamic watermarking?

The meaning of “dynamic watermarking” is more or less clear from its name.  Unlike static watermarks, a dynamic watermark can change after a publisher has applied it, typically based on context.  This context could include anything from the user who is viewing it to the date and time somebody opened the document.

However, while the definition of dynamic watermarking is agreed upon and documented, the methods of implementing it are not.  Dynamic watermarking solutions can vary wildly in their execution, with many offerings providing only the appearance of security as a result.

This blog will take a look at what dynamic document watermarks can be used for, the methods used to implement them, and how you can apply them.

Why are dynamic watermarks useful?

In a general sense, watermarks can be used for five purposes:

1. To verify authenticity
2. To remind a user of their obligations (“Do not distribute”, etc.)
3. To inform users who the copyright holder is
4. To deter sharing
5. To display the date/time of issue, print, or open

It is primarily in the final two use cases that dynamic watermarks are so useful.  While you could manually add a watermark with the intended recipient’s name to deter sharing, this is hardly feasible at scale.  And without dynamic watermarks, a truly accurate time stamp is simply not possible ­­­— time will always have elapsed between when you add the watermark and when a recipient opens or prints a document.

So, dynamic watermarks allow you to easily trace (and therefore deter) leaked documents by inserting identifying information.  They also ensure that any other information contained in the watermark is accurate and up to date.

Dynamic watermarking: software and file formats

The natural inclination when it comes to watermarking is to try to maintain the file format of the source document.  There is no getting around the fact that it’s usually more efficient to do everything in one application instead of switching between several.  However, while it may be tempting to attempt watermarking in SharePoint, Word, Adobe, etc., you’ll quickly find that their dynamic watermarking capabilities range from ineffective to non-existent.

  Dynamic Watermarking in Office 365

Let’s cut to the chase: Microsoft Word, Excel, SharePoint, etc. simply do not support the use of Dynamic Watermarks to protect documents.  You will have to turn to SharePoint plugins for the functionality, which are limited in their abilities.  Though you can indeed use them to add unique watermarks to documents, most require you to convert to PDF first anyway, and their ability to stop users from removing a watermark is shaky at best.  This is because the security is tacked on and delivered via the web browser, which can be manipulated.

To take an example, one solution that can protect SharePoint documents in their original format, Muhimbi, admits that there is a delay between when the user opens the document and when the details are inserted that can be manipulated to obtain a copy without the customized watermark.  It also does not work if files are sent to another location via ‘send a copy’, are downloaded outside the browser, are synced to OneDrive, or are shared via a link.

In other words, the security is filled with more holes than a sieve.  It won’t stop anybody who is determined to leak your documents from doing so.  On top of this, any update of any of the supported applications could break the functionality entirely.

Ultimately, the time you’ll save is very limited and the security improvements are minimal.  It’s just not worth it.

  Dynamic Watermarking of PDF files in Adobe Acrobat

Adobe Acrobat does not have native support for dynamic watermarking either.  This leaves two options: JavaScript or Add-ons.  Both have major issues.

JavaScript watermarking

As Adobe Acrobat allows the use and execution of JavaScript, it is possible to use it to insert dynamic information into a watermark such as the date.  However, this approach is very flawed:

1. It’s unlikely you can add user information, since users do not require an account to open Acrobat files.
2. Enabling JavaScript represents a major security vulnerability.  Hackers have consistently found ways to exploit Acrobat’s JavaScript to arbitrarily execute code on user’s systems and spread malware.
3. It is possible to export a version of the document with JavaScript removed, breaking the dynamic watermarking functionality.
4. Adobe Acrobat’s editing restrictions can be bypassed in seconds with an online tool, so users can just delete the watermark.

In short, using JavaScript for protection will likely just do more harm than good.

Adobe Acrobat plugins

Dynamic watermark generator Acrobat plugins have similar issues to JavaScript.  You often need to turn off Acrobat security if you want them to function correctly, which can open vulnerabilities that lead to malware.  Plugins can also be overruled, either intentionally or unintentionally, by other plugins.  This can stop their dynamic watermark functionality from working correctly or stop it from working at all.  Additionally, any update to the Acrobat software or another plugin can cause the watermark plugin to break.

Finally, plugins need admin rights to install, but can be written and published by anyone.  You can imagine the kind of harm that can be done if a malicious party were to create a fake watermarking plugin, particularly if it contains forged signatures that allow it to run in certified mode.

Adding dynamic watermarks to PDF files with Locklizard

As much as it would be nice to have a perfect solution that allows you to create documents of any format and apply strong protection, no such program exists.  The next best thing is to effectively protect documents in a format that maintains the layout and design of the original copy — and that’s what Locklizard Safeguard provides.

When it comes to dynamic document watermarking, Locklizard Safeguard has three distinct advantages over the solutions already discussed:

• It uses the PDF format, which almost all documents can be exported to.
• It does not use plugins, JavaScript, passwords, or browser-based security, all of which can be easily bypassed and some of which introduce serious vulnerabilities.
• It stops editing completely and locks documents to authorized devices, ensuring that watermarks cannot be removed and that users cannot share documents via typical methods.

Here’s how the process works from start to finish:

1. Export your document in PDF format.
   
2. Open the PDF in Locklizard Safeguard Writer and choose whether you want to prevent screenshots, printing, add dynamic print and view watermarks, expire the document on a fixed date, etc.
   

   Adding a text watermark

3. To add a dynamic watermark, open the ‘View watermarks’ tab and change the text appropriately.
   

   Adding a dynamic watermark

   To insert dynamic variables, press the icon and choose a variable from the list.  The default text automatically inserts the user’s name, company, email address, and a date and time stamp when the document is viewed.

4. Press the icon to change font formatting options such as text color and size.
   

   Changing watermark font size, style, and color of the text

5. Choose the watermark position via the dropdown and adjust the opacity slider to alter the transparency.
   

   Changing the watermark position and opacity.

6. If you want to add a dynamic watermark for when the document is printed, then repeat the above procedure in the Print Watermarks tab.
7. Press “Publish” and a 256-bit AES encrypted PDF file is created that can only be opened by authorized users with the Safeguard secure PDF reader.
   
8. You can change who is able to view your document at any point using the Safeguard Admin portal.  New users will be sent a license file, which they can only install on one PC or device (unless otherwise specified by you) and cannot transfer to anybody else.  Users will not be able to decrypt and view the document unless they have a valid license file and authorization to view it.
   
9. Open the PDF to view the dynamic watermarking.
   
   Personally identifying information such as the user’s name, company, and email address is pulled from the data entered about the user in the admin system.  This is then added to the watermark text.

  How to add a date and time stamp to a PDF

You can automatically add a date and time stamp by applying a dynamic watermark that includes the %DateTime% variable.  Here’s the process step-by-step:

1. Right-click your PDF in File Explorer and click “Make Secure PDF”.
   
2. In the “View Watermarks” and “Print Watermarks” tabs, tick “Add Text Watermark” and enter %DateTime% in the text box.  Also add any other information or variables you’d like to include.
   
3. Apply any other controls and press “Publish”.
   
4. Open your PDF to view the date/time stamp.
   

The best way to add dynamic watermarks to documents

Dynamic watermarking cannot be an effective security mechanism without being used in combination with digital rights management controls.  The simple fact is that it does not matter if your watermark identifies a user if they can easily remove it.  That’s why Locklizard combines dynamic watermarking with a series of modular DRM controls that are backed up by strong cryptography and secure licensing.

When you watermark a PDF with Locklizard, you also remove users’ ability to edit the document, open it on unauthorized devices, screengrab it, and more.  The only route to removing a watermark is to take picture of it with an external device and use try to remove it with photo manipulation tools.  If you place your watermark correctly, this is a very laborious and difficult task that would likely degrade the quality of the final copy.

To protect your PDF documents against copying, sharing, unauthorized access, and misuse take a 15-day free trial of our PDF DRM software.

   FAQs

Can you add a dynamic watermark in Word?

Not natively.  You have to use a solution such as Muhimibi PDF Converter.  However, just like Word watermarks can be easily removed, there are multiple ways for users to remove dynamic watermarks from Muhimibi.  A more secure solution would be to use Locklizard, since watermarks cannot be removed.

Do dynamic watermarks act as a deterrent?

Yes, they add an extra layer of security to a document since they discourage users from sharing sensitive information with others.

Does Locklizard let you add static text watermarks?

Yes, you can add static and dynamic text watermarks and static image watermarks (e.g. a logo or confidential stamp) and position them anywhere on the page.  You can have a different watermark for viewed and printed pages and change font, colour and font size.

Where does Locklizard get date and time information from?

Locklizard pulls accurate time data from a cloud or self-hosted server, depending on your choice of setup.  For offline files, date/time information is taken from the device.  Checks are made to see if a user has tampered with their system clock and protected documents will not open if this is the case.

Can you add a recipient’s email to a watermark?

Yes, Locklizard lets you add the dynamic variable %Email% which automatically inserts the recipient’s email address when the document is opened.  If you also want to add the recipient’s name then add the variable %UserName%.