Take Control of Confidential Content

by Penny Lunt

Continued from [ page 4 ]

Potential solution: Adobe Reader, Adobe Acrobat 6, Microsoft Information Services for Office 2003.

Adobe's Acrobat Professional 6.0 lets users set limits on PDF documents so that a recipient can't print, copy or edit it, and the PDF can also be encrypted and assigned password protection. Acrobat-assigned rights can't be "timed out," and once a document is released, the rights can't be changed.

Microsoft Information Services for Office 2003, as described earlier, lets authors click a button on the Office application toolbar to set rights and privileges for documents. RMS is required to enforce the rights.

Build-It-Yourself DRM: A Case Study

Software development company Integrated Management Concepts (IMC), Thousand Oaks, CA, makes MicroFusion Millennium software, which is designed to manage finances for large-budget, long-term projects. The software lets managers know when costs are getting out of hand, and it's used by large companies such as Boeing, Rolls Royce, Sikorsky and CSG Energy.

As IMC's market grew, it became clear that the company needed to provide digital rights beyond simple password protection. "This financial data is core to our customers' businesses, and they need to keep it away from people who should not have access, says IMC chief technology officer Chris Taylor. "Yet they need to give all levels of decision makers access to that information through a Web-based client."

The most important issue became granularity of content; it wasn't enough to give password protection for a file or project, IMC needed to be able to give some managers access to actual costs incurred in the previous six months, whereas other managers might need to see only forecasts.

IMC had recently rewritten its application to use XML to store data and began using x.509 digital certificates to authenticate users. The company decided to license the XRML language developed by Bethesda, MD-based ContentGuard to create a rights editor that would manage digital rights and interpret the rights of each individual.

Using the digital certificates and XRML layer, "most users don't know or care that this is going on," Taylor says. "They're given certificates, the system identifies who they are — it's invisible to them." XRML licenses are generated by a small number of users who grant rights to view, print, edit, add and delete content. For example, a project leader could let members of his workgroup view and print their portions of the current fiscal period data, while program managers might have additional rights to edit the current period data, but not the previous period data.

Future plans for IMC's digital rights features include the simple technical matter of upgrading to XRML 2.0 from version 1.3. "From a business-oriented perspective, we would like to see more tools like scheduling systems to work with our software using XRML, so that all content for a project could be protected," Taylor says. He expects other software developers to adopt the XRML language, so this may be less of a problem in the future.

A Starting Point

Before choosing a type of technology, the first thing an organization needs to do is assess its need for DRM. "If a company has a full-time, across-the-enterprise need, it will have to be willing to commit significant resources to reaching that goal and should be looking at high-end solutions such as IBM EMMS or Liquid Machines," says Wagner of Gartner. "On the other hand, if needs are more for workgroups or short-term solutions, then Microsoft's RMS would be a good solution."

Content management systems and access control systems can also offer protections. Assuming you want to continue down the DRM path, the main thing to look for is the ability to integrate with existing applications. "Unless your core business revolves around content and information that you buy and sell, you're not going to want to spend $100,000 or more on digital rights management," contends Rob Lancaster, senior analyst, Internet business strategies at The Yankee Group, Boston. "Typical enterprises will only use DRM technology if it's integrated into systems they are already using, such as document management systems, the enterprise portal, CAD/CAM design systems, or even embedded in the operating system that's managing their office documents."

[ BACK | NEXT ]