Managing and sharing Office files

Protecting an Office file

The Office applications enable you to protect a file (such as a document or workbook) that is shared with other users (particularly users on a network). The Protect Document settings help protect the content of the file and can also potentially restrict what can be changed in the document and by whom. To view these options, click the Protect Document button in the Info window, as shown in Figure 3-11.

Figure 3-11 Select a document protection strategy on the Info page.

The following options are available:

• Mark As Final: This command marks the file as final and makes the file read-only. All editing commands for the file are disabled; however, any user opening the document can remove the Mark As Final setting in the Backstage. This feature is primarily designed to keep users from inadvertently making changes to a file.

• Encrypt With Password: The file is encrypted and protected with a password. When you select this option, you are required to enter a password for the file. Only users with the password can open the file.

• Restrict Editing: This command opens the Restrict Formatting and Editing task pane in the document, presentation, or worksheet window. You can restrict formatting to a selection of styles and specify editing restrictions for the document, including making the document read-only.

• Restrict Access: This option enables you to take advantage of a Digital Rights Management server. This type of service allows you to assign users different permission levels for the file.

• Add A Digital Signature: You can digitally sign a file to prove its authenticity. Signing a file digitally requires that you obtain a digital certificate. A certificate authority can provide digital certificates.

The first three options provided by Protect Document are available to any kind of Office user (home, small business, or big business). The Mark As Final option is useful when you want your collaborators to know that the current version of the document is the final version. This setting also makes the file read-only, but anyone wanting to change the file can remove the Mark As Final attribute and edit away. So this option is not a strong security measure.

Encrypting the document with a password (the second option) definitely limits access to the file because the password is necessary to open it. This means that you also must keep track of the password because it is the only way to open the encrypted file. This is a strong security measure, but it can backfire if you forget the password for the file.

The Restrict Editing setting enables you to be somewhat selective in what you allow other users to do to the file. You can specify both formatting and editing restrictions using the Restrict Editing task pane. You can also choose parts of a document or worksheet and specify the users who can edit those portions of the file. This feature requires that you have user groups on your network, such as domain user groups on a Windows Server network.

The Restrict Access setting requires that you have access to a Digital Rights Management server (DRM server). So if you work in a corporate environment that provides a DRM server, you can take advantage of this way of securing Office files. Restricting access using a DRM server enables you to specify a particular user (by username or email address) and then assign a level of access to that user.

Digitally signing a file is a way to authenticate that a file is from a trusted source. So adding a digital signature to a file is more about letting users with whom you share the file know that the file is authentic and does not contain any malicious code that might damage their computers or computer files. Adding a digital signature to a file protects your collaborators—the people who review the shared file—more than it protects you from a particular security problem.

To digitally sign an Office file, you need a digital certificate. You can obtain digital certificates from an online certificate authority such as Symantec (symantec.com/ssl+certicate) and Digicert (digicert.com); depending on the size of your business, you might find digital certificates cost prohibitive. CAcert is a community-based certificate authority that offers certificates to members for free.

You can also create your own digital certificate using the Digital Certificate for VBA Projects utility provided with Office. Appendix B, “Office macros,” provides a complete walkthrough of using this utility in the section “Digitally signing macros.”

You should digitally sign a file only when you are providing a final draft to your collaborators. Signing the file marks the file as final, which makes it read-only. That means when you have a final file, and the certificate is on your computer, you are ready to go.

Click Protect Document and then Add A Digital Signature. The Sign dialog box opens. Enter the commitment type and the purpose for signing the file. Your default signing certificate is listed in the dialog box in the Signing As pane. You can click the Change button to locate a different certificate if you have multiple certificates on your computer.

When you are ready to sign the document, click Sign. The Signature Confirmation box opens, letting you know that your signature has been saved with the document. However, if the document is changed, the signature becomes invalid.