Protecting Document Outside Enterprise Network: A Confirmed Framework

• Published in: Enterprise Security Vol. 10131; pp. 259 - 275
• Main Authors: Aaber, Zeyad S., Wills, Gary B., Crowder, Richard M.
• Format: Book Chapter
• Language: English
• Published: Switzerland Springer International Publishing AG 2017; Springer International Publishing
• Series: Lecture Notes in Computer Science
• Subjects: Active document; DRM; Enterprise document security; Secure document sharing; Self-protecting documents
• ISBN: 3319543792; 9783319543796
• ISSN: 0302-9743; 1611-3349
• DOI: 10.1007/978-3-319-54380-2_12

Sharing e-documents are important components of any enterprise workflow. Keeping these e-documents secure is fundamental to enterprise security, especially in multi-site enterprises or when sharing e-documents with third party. For that purpose, enterprises use document management software. However, document leakage is the most challenging security issue. These leaks are mainly caused by internal attack wither intentional or due to accident and employee ignorance. After exploring the landscape of the current e-document sharing security issues, this chapter proposes a framework to address these issues. The proposed framework is adapting current technologies in new novel approach to deliver a secure environment to share e-documents and track them. The confirmed framework secures documents not only inside the enterprise, but also when they leave the enterprise boundaries via networks or portable devices. As the author’s knowledge extends, there is no other work similar to what this paper provide regarding proposing such a framework. The framework provides a persistent and secure environment through the e-document life cycle and ability to track the document. The framework components design is based on analysing the literature of the current issues and available solutions. These components were confirmed after surveying security professionals and interviewing fourteen security experts. The framework includes components utilising active document concept, digital right management concept, context awareness, and a central certification authority service.