IRM - EMC Community Network

permission or administrator can modify the document policy at any time. For example, an owner may want toremove users or groups from the list of authorized viewers. IRM client users with appropriate permissions can alsodefine their own document policy templates. When creating named policies, administrators can select the Globaloption which makes the policies available to all users.The other type of named policy is the shared document policy (also known as a referential policy), which alsoallows an administrator to create standard policies that can be selected by users when protecting documents.However, unlike a template, the policy can be applied to multiple documents, and changes to the shared policy affectthe documents protected by the policy. The document owner cannot make changes to a shared policy.Information owners, at the discretion of the administrator, may be granted the permission to create their own customdocument policies. This allows the information owner to determine access permissions and which users or groupsare allowed to access the protected content. This capability allows administrator to force information owners to usepredefined policies, or to be flexible in allowing the owners to define their own. Information owners who createtheir own custom document policies using the IRM client can also save their policies as personal templates for reuse.Policy OptionsPolicies are used to control the access rights available for a given document. Policy options include: An access list containing the users, groups and network locations, which can access the document Rights: document rights including print, copy from text, edit Available Date: the date the document will become available to users Expiration Date: A date or time-span after which no one will be able to access the document Watermark: Assign a watermark to be displayed when the document is printedPage Level and Document Level Protection (PDF Only)For protected PDF content, the IRM Server and IRM Client for PDF have the capability to encrypt the document asa whole using a document level policy or encrypt each page individually using a page level policy.A page level policy allows you to apply a different set of permissions and user access to selected pages within aprotected document. For example, you could protect a document so that one part is classified as confidential, anotherpart is secret, and a third part is top secret. You can distribute the protected document knowing that individuals willbe able to view only the sections they are authorized to view. The page level feature applies a different encryptionkey to each page whether or not you apply a different set of permissions to selected pages. Because of this, usingpage level in a large document may decrease performance. Also, page-level protection can result in a much largerfile due to the way Adobe optimizes image use.When an authorized user opens a protected PDF file that uses page-level encryption, a key request is made to theIRM Server every time the user changes pages. If the window size does not display the full page, scrolling down orup also causes a key request, since only the text that can be displayed in the window is decrypted.WatermarksA watermark is text that appears on a protected PDF, Word, Excel and PowerPoint document when a user prints thedocument. (Watermarks for e-mail are not supported.) The watermark also shows up on the screen while viewingPDF documents. The IRM Server administrator defines watermarks and can associate them with user groups,document policies, or for the whole server using server restrictions. A watermark could be as simple as including theword confidential across the top of a company confidential document. Watermarks can be more sophisticated byaltering their color, layout, and font or by including additional information such as the username of the user viewingthe document and the date and time they are viewing it.Watermarks are page specific, so each page may have a different watermark. It can even be sensitive to the type andversion of the IRM client used to view the document.The watermark feature also supports using double-byte characters (Chinese, Korean, or Japanese).Advanced Screen Capture DefeatEMC IRM includes features called Screen Capture Defeat, which provides protection from native MicrosoftWindows print screen functions, and Advanced Screen Capture Defeat (ASCD), which provides protection fromcommon 3rd party screen grabbing tools. IRM ASCD is an added deterrent to users who wish to take maliciousaction within a protected document. IRM ASCD is not a fail-proof mechanism for stopping a malicious user fromOverview of Technical Architecture Page 18