Managing and sharing 365 files

Protecting a 365 file

The 365 applications enable you to protect a file (such as a document or workbook) that is shared with other users (particularly users on a network). The Protect Document settings help protect the content of the file and can also potentially restrict what can be changed in the document and by whom. To view these options, click the Protect Document button in the Info window, as shown in Figure 3-10.

Figure 3-10 Select a document protection strategy on the Info page.

The following options are available:

• Always Open Read-Only: When you choose this option, documents you share are opened in read-only mode. This feature is primarily designed to keep users from inadvertently making changes to a file upon first inspection.

• Encrypt With Password: The file is encrypted and protected with a password. When you select this option, you are required to enter a password for the file. Only users with the password can open the file.

• Restrict Editing: This command opens the Restrict Formatting and Editing task pane in the document, presentation, or worksheet window. You can restrict formatting to a selection of styles and specify editing restrictions for the document, including making the document read-only.

• Restrict Access: This option enables you to take advantage of a Digital Rights Management server. This type of service allows you to assign users different permission levels for the file.

• Add A Digital Signature: You can digitally sign a file to prove its authenticity. Signing a file digitally requires that you obtain a digital certificate. A certificate authority can provide digital certificates.

• Mark As Final: This command marks the file as final and makes the file read-only. All editing commands for the file are disabled; however, any user opening the document can remove the Mark As Final setting in the Backstage.

The first three options provided by Protect Document are available to 365 users (home, small business, or big business). The Always Open Read-Only option is useful when you want your collaborators to opt-in to editing privileges by providing for a read-only look at the document prior to having editing access to the file.

Encrypting the document with a password (the second option) definitely limits access to the file because the password is necessary to open it. This means that you also must keep track of the password because it is the only way to open the encrypted file. This is a strong security measure, but it can backfire if you forget the password for the file.

The Restrict Editing setting enables you to be somewhat selective in what you allow other users to do to the file. You can specify both formatting and editing restrictions using the Restrict Editing task pane. You can also choose parts of a document or worksheet and specify the users who can edit those portions of the file. This feature requires that you have user groups on your network, such as domain user groups on a Windows Server network.

The Restrict Access setting requires that you have access to a Digital Rights Management server (DRM server). So if you work in a corporate environment that provides a DRM server, you can take advantage of this way of securing your files. Restricting access using a DRM server enables you to specify a particular user (by username or email address) and then assign a level of access to that user.

Digitally signing a file is a way to authenticate that a file is from a trusted source. So adding a digital signature to a file is more about letting users with whom you share the file know that the file is authentic and does not contain any malicious code that might damage their computers or computer files. Adding a digital signature to a file protects your collaborators—the people who review the shared file—more than it protects you from a particular security problem.

To digitally sign a file, you need a digital certificate. You can obtain digital certificates from an online certificate authority such as Global Sign (globalsign.com) and Digicert (digicert.com); depending on the size of your business, you might find digital certificates cost prohibitive. CAcert (www.cacert.org) is a community-based certificate authority that offers certificates to members for free.

You can also create a digital certificate using the Digital Certificate for VBA Projects utility provided with 365. Appendix B, “365 macros,” provides a walkthrough of using this utility in the section “Digitally signing macros.”

You should digitally sign a file only when you are providing a final draft to your collaborators. Signing the file marks the file as final, which makes it read-only. That means when you have a final file, and the certificate is on your computer, you are ready to go.

Click Protect Document and then Add A Digital Signature. The Sign dialog box opens. Enter the commitment type and the purpose for signing the file. Your default signing certificate is listed in the dialog box in the Signing As pane. You can click the Change button to locate a different certificate if you have multiple certificates on your computer.

When you are ready to sign the document, click Sign. The Signature Confirmation box opens, letting you know that your signature has been saved with the document. However, if the document is changed, the signature becomes invalid.