PDF Security Software (DRM): control viewing, copying, sharing and printing

Protecting users against embedded javascript and dangerous links

• use Antivirus software that protects against embedded javascript and scans standard PDF files
• avoid opening PDF files from unknown sources
• avoid suspicious links within PDF files
• use a secure PDF reader such as Javelin3 (for Windows, macOS, Android and iOS), Sumatra (for Windows), or Preview (for macOS)
• Use web-based pre-converted PDFs so that there are no embedded risk elements (pure HTML5 - see for example Webdoxx)

Other options include Adobe reader or Foxit reader with Javascript disabled or DRM service branded versions of these mainstream readers, which may have Javascript enabled in order to provide the DRM functionality required. Particular care should also be taken when using mobile devices as potential rogue links may not be easily checked

Link security check in the Adobe software - Javelin3 for Windows protection is similar

Prevent users and "bots" from copying content

To ensure content is kept exactly as intended and not copied:

• avoid applying Adobe-style password protection (see image below) - typically this a weak form of protection - often easily removed using free Online services like SmallPDF or using specialist tools like those from Elcomsoft, or by using PDF readers that simply ignore some or all of the Adobe-style security settings (like Mac Preview, Google Drive and our own Javelin3 secure PDF reader)
• use strongly encrypted PDF files provided by bespoke software and DRM service controls for the best protection. These systems utilize encryption forms that are extremely difficult or impossible to break
• Some Online services may be at higher risk than Offline solutions, depending on how they are implemented and the level of access control applied - check their protection

Copy and Print control selection in the Adobe Acrobat software, Protect tool (very weak security)

Prevent users from printing content or permit limited secure printing

With Adobe-style PDF security settings printing can be disabled or limited to 150dpi. However, as this security can be easily removed or ignored (as described for content protection, above) this facility is of limited value. With an Offline PDF DRM solution printing is either never permitted or only permitted from certain types of device (e.g. PCs and Macs) and should be allowed only to real physical printers (i.e. not to virtual devices, images files or to PDF). Limits on the number of print events and/or number of pages printed can be provided by such services and software, as illustrated below. With Online PDF DRM services this restriction is not available where standard web browsers are used, so printing should be disabled or limited by including on-print dynamic watermarking to identify the user, image-only based printing and limiting the number of pages printed at one time

Print control selection in the free DrumlinPublisher software, Set Permissions tab

Prevention of File Save As... operations

Implemented on some systems as Export or Convert - Prevention requires the use of an Offline or Online PDF DRM service and reader/viewer that does not provide these facilities. Saving a copy in a different location or renaming a secured file is generally permitted with Offline services. Such services ensure that secured files can only be saved with the security remaining in place - thus files may be saved under a different filename or location, but not in formats other than the secured version. With Online services there should be no facilities to save as or download the content being viewed - the best protection is for pre-converted files so the source is never available, even to hackers

Selecting the Export or Convert option in Adobe Reader

Prevention of copying or sharing of an entire file

With standard PDFs, even when the file itself has Adobe-style security applied, there is nothing to prevent the file being shared with others. This is the key protection provided by the use of an Offline or Online PDF DRM service. Such services check a central server database when the secured PDF is opened to see if that user has permission to view and/or print that specific document. Additional checks might apply, such as valid date checks, location checks or device checks. For Offline service access control can be based on user plus device information. With Online services there is a risk of file sharing through the sharing of usernames and passwords unless two-factor authentication is implemented (2FA) using software like Google Authenticator, SMS text message or email authentication - other techniques, such as session-based controls, IPAddress authentication and cookies can provide alternative or additional security for Online services

Google Authenticator app

With an authenticator app, or a similar 2FA facility, security is greatly increased as it can limit the risk of file sharing with Online services. However, it requires a slightly more complex login process for end users that may not be acceptable, or may suffer from technical issues that affect valid users from accessing the service. Recently that has been the case with Microsoft's authentication app

Static Watermarking

Additional text or image provided on some/all pages as foreground or background overlay (possibly hidden). With standard PDF files static watermarks are simply edited elements (e.g. "Copyright ABC Inc") and can be removed with a PDF Editor. With strongly encrypted PDFs static watermarks can be more difficult or impossible to remove. Static watermarks by themselves are of limited value, but can be combined with Dynamic watermarking in DRM-secured software to provide increased document content protection

Static watermarking using Adobe Acrobat software, Add Watermarks tab

Dynamic Watermarking: showing user- or device-specific details

Typically provided by secure offline PDF DRM services with strongly encrypted PDF files to uniquely identify the user and related information (e.g. name, organization, email, IPAddress, deviceID, date/time, filename). In the example illustrated below, "(c) 2025" is static content, whilst "%a and %u" are placeholder variables that are replaced by user-related content when displayed on an end user's device. Dynamic watermarking is always recommended for Online PDF security services, where user login details and related data (e.g. username, document name, date, time, IPAddress) can be included

Dynamic watermarking in the free DrumlinPublisher software, Add Watermarks tab

Personalized PDF Stamping is a form of dynamic watermarking - see further, the Monetization topic below. The DrumlinPublisher Personalization tab enables additional publisher-defined variables for dynamic stamping and file-naming

Screen capture

Prevention of single- or multi-page screen capturing. Only the Android OS has built-in optional screen capture protection. On Windows, macOS and iOS screen capture can be largely prevented when proprietary PDF readers like Javelin3 are used in conjunction with a central DRM service and encrypted files. Online solutions using standard web browsers without plugins cannot prevent screen capture, but they can optionally prevent capture using external capture programs - as illustrated here. For both Offline and Online services the use of on-window dynamic watermarking is strongly recommended in order to provide an additional level of security. If all or the majority of end users are intra- or extra-corporates or government agencies, it is often better to rely on dynamic watermarks as these types of organization may not permit closure of background screen capture processes

Example Screen Capture process - Javelin3 for Windows

Audit and tracking

Ensuring the usage of specific files is tracked and actions are logged locally and centrally, including monitoring attempts to acccess files by unauthorized users. With Offline services this requires a central DRM server and background (silent) data communication when an internet connection is present; with Online DRM actvity logging is standard, typically including date/time, user, document and IPAddress details

Activity tracking in the free DrumlinPublisher software

Control of who is permitted to view a PDF file

Can be provided via Certificate-based security using standard Adobe-based facilities, but typicaly requires an Online or Offline DRM service. Revoking access requires removing the permission to view a specific PDF, or all PDFs, from one or more users. With Offline services this requires the user to have an internet connection at the point the document is opened and/or whilst viewed; with Online services this is typically an instant permission enabling/disabling/removal step

User management in the Webdoxx Online software

Reporting on usage

Ensuring that only authorized users can view selected documents, retain them for a specified period, and record and report on compliance to such controls, including viewing and printing. Requires use of an Offline or Online DRM service, with activity logging and reporting facilities. Often augmented with downloadable data or special central service reporting functionality. Logged data should be selected by user, date/time window and event types, and then made available for review

Sample log data selection for report generation in the Webdoxx Online software

Supporting visually impaired users

Questions to consider include:

• Does the software and service offering have usable options for text-to-speech (TTS) or read-aloud on a cross-platform and multi-lingual basis?
• Can pages be zoomed easily to increase readability? Note that the PDF format is page-based so does not support font-size changing as standard
• Does the PDF reader software support the "Ease of Access" facilities available in modern device operating systems? (for example, Magnifier support; Color filters and High Contrast modes)
• Are special service variants available for such users? (for example, selectable full or partial professional audio narration)
• Can screen reader software (like NVDA) be used in conjunction with the service?

With the Drumlin Offline service and Javelin3 readers, text-to-speech is supported using the TTS/Narrator facilities provided within the underlying operating system; and with the Webdoxx Online services a range of TTS and embedded audio and video elements are available and widely used in educational and training environments, including support for screen-reader technologies - see our blog article on this topic, and this Brighter Minds Case Study

Costs

Most "standard" Adobe-style PDF security software is either free (typically provided by web-based services) or relies on relatively low cost PDF editor software. There are also many free and low cost services for publishing PDF files as flipbooks or similar (e.g. ISSUU - from $30/m for limited functionality to $270/m for Ad free larger-scale usage; other providers, like Flipbooks, are often cheaper). Typically this type of web service does not provide fully secure services. Professional PDF DRM software and services can be costly - services from providers like Adobe, Vitrium, FileOpen and Locklizard range from $1000s to $10,000s per annum, and typically service costs are provided only by individual quotation. Costs which must be added include setup, special licensing, service management, user management, and technical support costs.

Drumlin and Webdoxx PDF DRM software is free and services start at as low as $25 per month with no setup fee, depending on the scale and complexity of the publisher's requirements - contact us to discuss your requirements and for a free demonstration and quote using your own sample files