How to add security to a PDF that is permanent

The problem with Adobe PDF encryption & how to add security to a PDF that cannot be removed

In this blog, we’re going to cover 8 easy ways to add security to a PDF so that it cannot be shared, copied, edited, or printed.  We will cover why Adobe PDF encryption is not secure, why other PDF password protection systems are just as useless, and why using PDF DRM is the best way to protect PDF files.

  How secure is Adobe Encryption?

Though the encryption algorithm used by Adobe PDF is very strong (up to AES 256-bit), its implementation is not.  The crux of the issue is that Adobe allows users to decrypt and open the document by entering a password.

  Are PDF passwords secure?

Passwords alone just aren’t a good way to protect documents (or anything important, really).  In the case of Adobe PDF protection, there are two passwords: the open password and the permissions password.  Each has a different function, and each has serious security flaws.  Let’s start by discussing the open password.

PDF open passwords

Remember that encryption we talked about earlier?  Usually, to break it, an attacker has to find a flaw in the encryption algorithm or spend thousands of years trying to guess all possible encryption keys.  Adobe, however, allows users to set a password that, when entered, will decrypt the file and grant access to the document.

All of a sudden, the strength of the protection lies not on how strong the encryption algorithm is, but on what password the document creator chooses.  A short, memorable password can be brute-forced in seconds or minutes by applications such as Elcomsoft.

For the sake of argument, however, let’s say that you choose an 18-character password that uses a combination of letters, numbers, and symbols.  Is your document now adequately protected?

Well, it depends on what you’re trying to protect it against.  If you just want to protect your document when it is in transit or sitting on a server/computer, then, for the most part, yes.  It does not, however, provide much protection once the recipient opens the file.

Why?  You need to share the password with the recipient for them to be able to open it. If you can share it, so can they.  With anyone they like, without you knowing.  The PDF open password is not a good way to prevent the unauthorized distribution of confidential information.

PDF permissions passwords

PDF permissions passwords are close to useless.  Adobe permissions are backed up not by strong cryptography but by an honor system.  They rely on developers of PDF viewers being kind enough to enforce them.

The reality, of course, is that many don’t, and other developers intentionally degrade Adobe permissions by creating free cracking tools.  As a result, today permissions passwords can be removed in seconds by any number of websites or applications.

What about other PDF password protection solutions?

They’re all based on Adobe, which means they have the same issues.  Any PDF encryption that uses passwords and/or an honor system will always be inherently flawed.

So, what should you use if you want to protect your documents from unauthorized sharing, editing, printing, and screen grabbing?  We think that our DRM tool, Safeguard PDF Security, does a pretty good job.  Here’s how you can use it to secure your document in a variety of ways.

  How to secure a PDF from sharing

Locklizard Safeguard can stop users from sharing PDFs by locking their usage to specific devices and locations.  An employee may only be able to open a document on their BYOD laptop when connected to the office Wi-Fi, for example.  Here’s how to achieve this step-by-step:

1. Right-click a PDF on your computer and press ‘Make Secure PDF’ to open it in Locklizard Safeguard Writer.
   
2. Press ‘Publish’ at the bottom of the dialog to encrypt the PDF.
   
3. Open your Safeguard Administration System and log in.
   
4. In the ‘Customers’ tab, press ‘Add’ and enter the details of the user you want to grant access to.
   
5. In the ‘Manage Access’ tab, press ‘Set Document Access’.
   

6. Choose the document you just encrypted and press ‘OK’, then ‘Add’ on the customer screen.
   
   The user will be emailed their license file.  Once installed on their device, it won’t be able to be used elsewhere.  Therefore, usage is locked to authorized devices.
7. To lock use to a location, press ‘Manage’ in the ‘Customers’ tab and click the ‘Details’ arrow next to their name.
   
8. In the ‘Restrict Location’ field, enter an IP address or IP address range and/or country to restrict the location from where the user can open documents, and then hit ‘Save’.
   
   You can also tick ‘Auto Detect & Restrict’ instead, which will automatically use the IP address that the user registers their license from and limit document use to that location.

  How to secure a PDF from printing

Unlike Adobe Acrobat, Safeguard’s print restrictions do not rely on an honor system – users can only view the document in the Safeguard Viewer application, which stops them from printing unless they have express permission.  Here’s how to secure a PDF from printing with Safeguard step-by-step:

1. Right-click a PDF on your computer and press ‘Make Secure PDF’ to open it in Locklizard Safeguard Writer.
   
2. Open the ‘Printing & Viewing’ tab and make sure ‘Allow Printing’ is unticked.
   
3. If you want to prevent printing for all users but allow specific users to print, then check the ‘limit number of copies to’ box and set the number of prints to 0.  You can then change the number of prints available for each user on the Safeguard Admin portal.
   
   You can also decide whether or not printing is degraded.
4. Press ‘Publish’.
   
5. Add the relevant users to the document in the Safeguard Admin portal to grant them access to view (but not print) the document.

  How to secure a PDF from copying, copy/paste

When you secure a PDF with Safeguard it is automatically protected against copying.  Users will be unable to copy and paste from the document in the secure viewer, and sending a copy of the file itself is pointless since the person they share it with will need a valid license file installed on their computer to open it.

1. Right-click a PDF on your computer and press ‘Make Secure PDF’ to open it in Safeguard Writer.
   
2. Select any additional controls and press ‘Publish’ to encrypt your PDF.
   
3. Grant users access to your document in the Safeguard Admin portal.  All users who can view the document will be unable to copy/paste from it.

  How to secure a PDF from editing

Locklizard automatically secures a PDF from editing when you publish the PDF.  The document will only be viewable in the Safeguard Viewer application, which does not allow users to modify text, images, layout, or any other elements.  Users can only highlight, underline, and comment.

The process to disable PDF editing with Safeguard Writer is the same as in the section above:

1. Right-click a PDF on your computer and press ‘Make Secure PDF’ to open it in Safeguard Writer.
   
2. Select any additional controls and press ‘Publish’ to encrypt your PDF.
   
3. Grant users access to your document in the Safeguard Admin portal.  All users who can view the document will be unable to copy/paste from it.

  How to add dynamic and permanent watermarks

Watermarks are not an effective protection mechanism alone – most please do not distribute without permission disclaimers just go ignored. But when combined with anti-editing, screen grabbing, and sharing controls, they can be quite useful.  Generally, you would use Safeguard’s watermarks to dynamically insert identifying user information (email, company etc.) at view or print time so that users cannot take a picture of their screen or distribute a printed document without it being contributable to them.

Here’s how to add watermarks in Safeguard PDF writer:

1. Right-click on a PDF file and select “Make Secure PDF”.
   

2. Open the ‘View Watermarks’ tab and check the ‘Add Text Watermark’ box.
   
   When adding your watermark text, you can add dynamic variables.  To do so, press the editing icon and choose an option – for example, %UserName% or %Email%.  This will be replaced by their actual information when the document is opened in the viewer application, saving you from protecting each PDF individually.  You can also adjust the ‘Position’ and ‘Opacity’ sliders to modify the watermark so that it is more or less invasive.  You can also use the ‘Aa’ icon to adjust the font. Optionally, switch to the ‘Image Watermark’ tab and add a picture watermark there instead.  This will not be dynamic.

3. Open the ‘Print Watermarks’ tab and check ‘Add Text Watermark’.

   
   Modify the dynamic variables and other options once more until you are happy with the way it looks.

4. Add any additional DRM controls and press ‘Publish’ to save it in an encrypted format with the watermark enabled.
   
5. Grant users access to the document in your Safeguard Admin portal.  The watermarks will automatically populate with their information when they open/print the PDF.
   

  How to stop screenshots of PDF content

Adobe Reader does not stop screenshots of PDF content and nor can browser-based PDF security.  Locklizard Safeguard blanks out the viewer application when a user tries to capture it with both first and third-party screen-grabbing applications.  This setting is enabled by default, but you can double-check by following the steps below:

1. Open the ‘Environment Controls’ tab of your Safeguard Writer application.
   

2. Make sure ‘Disallow screen capture’ is selected.
   
   Optionally, tick ‘Add screen mask’ to grey out the viewer application when the document is not in focus (to prevent somebody from manually referencing the text to type into another document).

3. Press ‘Publish’ and distribute the protected document to users.

   

  How to make a PDF expire

Safeguard grants publishers various expiry options, including the ability to revoke access to the PDF after a certain date, a number of days after the first use, and a number of views/prints.  Adding expiry options in the Safeguard Writer application is simple:

1. Open the ‘Expiry & Validity’ tab in Safeguard Writer and tick/customize your time-based expiry options.
   
   Pay particular attention to the ‘Verify Document Access’ section, which will determine how often the server checks whether the user’s license is still valid.
   

2. To enable print and view expiry, open the ‘Printing & Viewing tab and tick ‘No access after print copies depleted’ and ‘Limit number of views to:’.
   

3. Press ‘Publish’ and distribute the protected document to users.

   

  How to track PDF use

Tracking when and on which device a PDF has been opened can be useful for both compliance and tracking down leaks or copyright infringement.  You can enable logging in Safeguard PDF Security by ticking the ‘Log print requests’ and ‘Log document views’ options in the ‘Printing & Viewing’ tab of the  Writer application.

  How to send a secure PDF via email

Once you have applied all of the necessary controls to your document and published it, you can send the secure PDF file over email as you would any other file.  As users cannot open it unless they have a valid license file on their computer and the file is protected with 256-bit AES encryption, there are no risks associated with its interception.

For Gmail-specific advice, including coverage of Gmail Confidential mode, see How to send secure email attachments in Gmail.

  The best way to add security to a PDF

With effective, enforceable controls, no use of insecure passwords, and a variety of enhanced watermarking, logging, and expiry options, Safeguard PDF Security offers a far better value proposition for companies that want to prevent unauthorized editing, copying, and distribution of their PDF files.  Unlike other PDF Security solutions, users cannot convert protected PDF docs to Word or other file formats, or save them as unprotected PDFs.

To add security to your PDF without passwords and protect your royalties or sensitive information, take a 15-day free trial of our DRM software.