Print Management Security

Secure Printing and security watermarks.

Secure print management with DRM: protect important documents and improve print security – prevent printing of documents or enable printing, enforce watermarks & control print use.

Protecting documents and printing documents securely

There are many questions about the absolute security of protected PDF Documents, but one of the biggest sources of weakness is being able to make a printed copy of a secured document – allowing printing at all creates enormous opportunities for any protected document user.  So how do you protect important documents and improve print security, discourage users from making unauthorized photocopies, or just stop confidential and sensitive documents from being printed to begin with?

Control printing within the domain

You can insist that protected documents can only be used in controlled domains where devices on the network have to be physically authenticated.  On the face of it, this seems to provide a controlled environment for secure printed documents, but it doesn’t stop an authorized user from walking out with printed copies.  With remote working, enforcing printing within a domain is not a viable option since local print copies are required.

Forget about networks and domains for print control

Many secure print management security solutions rely on secure connections between the user and the printing device.  And they may be fine where you can establish physical boundaries – an investment management team, a matter team for a law firm, a medical research laboratory and so on.  But mainly life is not so simple.  In most lines of business (training, conferences, education, maintenance instruction packs and so on) allowing the authorized user, wherever they may be, to make at least one printed copy of many of the protected documents they have access to is a business requirement rather than an option.

Security watermarks change the boundaries

Secure print management watermarks offer a way forward in preventing document misuse.  They can do this in several ways.  Security watermark printing can be used just like the classical banknote watermark – establishing that the protected document is valid and not a forgery.  This can be of critical importance where the document is a formulation or an ‘official copy’ of a reference document such as an invitation or document of appointment.  But this is all about authenticating the document instead of requiring a digital signature, which is only useful before printing to authenticate the document in a file, and no use once it is printed.  But this kind of security watermark says nothing about the authorized user and linking them to the printed document.

Other uses for security watermark printing

Print watermarks may help protect important documents and improve print security by identifying the authorized user, perhaps by name or at least by an identifier, and include the time and date the print was made and identifying the ‘owner’ of the document.  Naturally you want a watermarking system that only reveals itself when the document is printed (i.e. only show a watermark when the document is printed and not when viewed) so there is no time to plan an attack on the security watermarks.  This approach should be coupled with logging the creating of printed copies which can identify time and date and IP location of the machine making the printed copy.  These may be useful when identifying what took place and when, by whom and where.

Separation of printing and viewing watermarks

In this article we have been concentrating on printed watermarks, but of course security watermarks should be applied to the visual image on the screen as well as on print out.  Naturally any secure print management security system will provide facilities that allow screen watermarks to be different from print watermarks.  View watermarks will need to be less visually intrusive than the print ones.  But View watermarks must not be forgotten since anything displayed on a screen can be captured on a cell phone – watermarks and all.  They should follow similar guidelines as mentioned in the later section on methods of attack against security watermarks.  See document watermarks on to how to create secure watermarks to deter copying.

Printing documents securely

Generally, the concept of printing documents securely goes back to printing currency banknotes, share certificates, bonds (particularly bearer bonds where the person holding them is the owner), bills of lading and so on.  This is a very important secure printing requirement, but certainly over the top when it comes to the normal kinds of secure document printing that commercial users actually need – a risk analysis says that the cost of setting up that kind of security printing is far too expensive and technically complex for the average IT shop.

Secure printing and ways to prevent photocopying

The simplest way to prevent photocopying is not to allow printing.  Secure printing does not prevent photocopying, it just discourages it.  Most people experience security printing with banknotes or checks (cheques for the English) where any attempt to photocopy them either loses images or reveals hidden text (such as the word FRAUD) on the document.  This obviously can be done, but it requires a specialist watermark printing and the equipment needed is simply not affordable in even technically sophisticated IT units let alone a home office or a medium scale industry.  So, until there is a revolution in printing technology (which seems unlikely) one must use methods such as security watermarks on printed copies, and design them so that they are difficult to miss out with a photocopier – put them on different places on the pages – identify the authorized user, that will help encourage them not to photocopy and distribute printed documents since it identifies them as the source of the photocopied document.

Common methods of attack against security watermarks and ways of defending

There are a limited number of ways in which security watermarks are added to PDF documents usually as a background fixed by an Adobe product editor that will add an extra layer that may be opaque or transparent.  Although in theory the document should only be available to edit by entering a password, the password can be given away, and on a number of products and platforms the PDF is available to edit directly or the background is immediately removed leaving the watermark secured document without any protection.

The simplest and most effective way to avoid this kind of attack is to create a system that does not allow protected PDF files to be saved in PDF format.  Preventing use of the PDF format prevents hackers from being able to exploit security weaknesses in products that were not designed to enforce Digital Rights Management controls and processing.

Do not use a light color for a security watermark because a photocopier may be able to lose the watermark image using contrast settings.  Also try to use a common color in use in the protected document to prevent a hacker from scanning in a printed copy and then using a graphics package (such as Photoshop) to remove that color from the document.  Typically, the commonest color in a document is black so setting the security watermark to black makes it very hard work to remove the watermarks other than manually.

If you are using text watermarks be sure to use a ‘thin’ typeface with a large size font so it covers more of the page without making it unreadable.

Protect important documents and improve print security

Locklizard provides strong document security software for PDF files that enable you to create a:

• secure print infrastructure – who can print, what they can print
• secure print output – watermark printed copies with user identifiable information, and log print use

Our PDF DRM software controls document use both inside and outside your organization, enabling you to stop document printing or enable document prints and control print use.

• protect a PDF with no printing allowed but enable printing for individual users
• create a secure PDF watermark that only shows when printed
• create dynamic watermarks (user and system information inserted at print time so that you only have to protect a PDF document once for distribution to all users)
• log document prints – see what users printed a document and when
• lock documents and print use to specific devices
• lock documents and print use to locations
• allow only degraded printing (greyscale or black & white)
• limit the number of prints
• automatically stop printing to PDF and other file formats