As the manager or owner of a company looking to share PDF documents securely, you have probably come across the data room as an option. It allows you to upload files and have them encrypted so that they can be accessed securely. Thereafter, the people who receive credentials from you can log in and view the content.
If you review the different data room service providers, you will notice that they all make a lot of promises about how secure their systems are. Nonetheless, they need to solve some issues before they can truly deliver on the security front.
Issues That Make Data Rooms Insecure.
A login system relies on the premise that people will not share their credentials with other people. Once someone has shared their login credentials then non-authorized users will have access to your protected documents – and this is probably what you were trying to avoid by using a data room to securely share information.
As evidenced by history, people do not have a problem with stealing their employer’s information and sharing it with the world. Snowden is one example of people sharing their employer’s information. What makes you think that your employees and the third parties with which you deal would not do the same if you cannot trace a leak back to them?
So, monitoring incoming IP addresses could be beneficial and may help prevent people from
indiscriminately sharing their login details.
Users can exploit a few loopholes to make copies of your documents when you use a data room. If you allow printing this could cause you a lot of trouble. Rather than print to paper, a user can print to a file driver which creates another unprotected file such as PDF format. The will result in a file without any of the protections or security measures you added to prevent unauthorized access or use.
Of course, you can disallow printing and stop the use of specific keys (such as a print screen). However, a determined user can even find ways around such controls by using third-party apps that record what is on display. And, if there are no watermarks on the documents identify users, then users can share these copies with anyone without any direct consequences.
Reliance on Browsers
Uploading Unprotected Files
Data rooms require that you create the file on your computer before you can upload it. And, only after it is stored on the data rooms server is it encrypted. This means that there could be a few copies of unprotected files that you make that could always find their way into the wrong hands – what happens if there is a system crash or something goes wrong with the protection process? Temporary files would remain on disk. Even if files are deleted, they could still be recovered. So you have no control over whether unprotected copies of your files are available on a web server.
Locking Access to a Location
This is a simple attempt to add security to ensure that users can only log in from certain locations. However, users can quickly get around this as using a proxy could fool a browser into believing that you are in one place when you are actually in another. It is, therefore, ineffective.
The holes mentioned above would need plugging for a data room to be considered secure. Otherwise, you would be paying for a service that does not guarantee PDF security. Also, you need to consider that users would need to be online to view protected PDFs.
So, if you are serious about sharing documents securely then look into better alternatives such as PDF DRM systems that don’t force users to be online or login to view protected PDFs. A secure PDF DRM system like Locklizard will lock documents to authorized devices so they cannot be shared with others.
So data rooms might seem like a quick and easy solution to PDF and document security but if they do not stop users from sharing protected documents then there is not much point in using them.