PDF Security and Digital Rights Management (DRM)

PDF DRM (Digital Rights Management) is the term used to describe the application of DRM technologies to PDF documents to control how they can be accessed and used, preventing unauthorized copying, printing, or distribution. It acts as a security layer to protect intellectual property rights associated with the PDF content. The key functionality that a DRM provides is the prevention of unauthorized file-sharing. It does this by checking that when a PDF file is opened (offline or online) the user and/or device has permission to view the document. This facility involves the use of a central DRM server, typically an SQL database facility, that contains details of each document, user and/or device details, permissioning records, and usage tracking and reporting facilities. Advanced PDF security services use a combination of technciques and functionality to support the security required. These include strong file encryption, silent bacground checks on service usage, tracking activity, facilities to enable and remove access to specific documents on a per user basis, and facilities to specify start and end dates on document usage.

  How can organizations generate truly secure PDF files?

Basic content security can be provided using standard "Password Protect" facilities in PDF editing software, like Adobe Acrobat and Foxit Editor, but these rely on weak control methods that do not really protect the content or the files from misuse, including copying and sharing the files with others. Password security is easily removed using free or low cost software tools, and is ignored by many non-Adobe PDF readers. Furthermore, a password-protected PDF file can be shared with any number of users, so really offers no protection at all.

Professionally protected PDF files require the use of an Offline DRM service and software, such as the Drumlin Service (free to try) or specialist Adobe-based DRM services (e.g. Adobe ACS) and modified Adobe or Foxit reader software as used by a number of PDF DRM providers. Online web-based PDF DRM solutions with unmodified web browsers are also available, such as Webdoxx and Vitrium (see further, below). With Webdoxx no PDF files are retained online or transmitted to end users, so this service provides a greater level of security than most other options available

In addition to security issues, the following also need careful consideration when selecting any PDF security solution:

  • software and service functionality - e.g. support for ecommerce, and for requirements like print controls, dynamic watermarking, document markup and screen capture protection
  • software licensing and service costs (one time and/or subscriptions)
  • service management time and cost (setup and operational costs)
  • service complexity (any additional consultancy, training and bespoke development costs, including branding)
  • service scalability (any additional costs and practicality associated with supporting very large numbers of end users)
  • quality and speed of support (24/7/365)

  What about web-based PDF display?

PDF files can be displayed Online within selected browsers, although some will simply download the source PDF and display the file within a local PDF reader, like Adobe reader or macOS Preview. With secure web-based systems, using a combination of user access controls with prevention of copying content, printing and saving, PDF files can be displayed after static or dynamic conversion to HTML5 format. Prior static conversion, such as is provided by Webdoxx, results in files that are faster to display and are typically more secure. In general Online systems have the advantage of being very easy to use, not requiring any special software installation on the user's device, and are highly scalable for very large numbers of end users with minimal service management and support. The main disadvantages are: (i) that the services requires Online access at all times; (ii) are not as secure as an Offline service; (iii) source PDF files have to be uploaded to the web service and in most instances are retained on that service (although not with Webdoxx); (iv) cannot offer secure printing; and (v) cannot protect against screen capture. Browser plugins and/or non-standard browsers may be able to resolve some of these issues, but suffer from the requirement for special end user software installation, often undesirable in many institutional sectors (e.g. education, government, finance, health)