The right tool

There are a couple of other things you can do if you’re worried about the security of your Office documents. Word, PowerPoint and Excel all allow you to password-protect documents. You can have one password that allows the document to be opened as read-only and another to allow editing of the document. In the latest versions of Office, you can choose how strong encryption is to be used to encode the document. None of it’s foolproof, of course, as all encryption can be cracked given sufficient will; it’s just a matter of how long it would take. Still, password protecting a document will stop casual prying. Applying passwords to a document is done in Tools | Options… | Security in the relevant application once you’ve opened the file.

Digitally signing a document will ‘prove’ that it came from you and that it hasn’t been altered by anyone since it left you – Word, PowerPoint, Excel and Outlook all allow you to sign documents or messages. Other applications such as Adobe Acrobat let you sign their files, but often the signatures aren’t transferable; for instance, signatures won’t transfer from a signed Word document to a PDF file generated from that document.

Signatures are generated from Public Key/Private Key certificates held on the user’s PC. Note that unless you make reasonable efforts to keep your PC secure – such as using frequently changed, strong passwords, locking your PC when away from desk, requiring the password to be entered on return from the screensaver and so on – your digital signature may not mean much anyway, because without these precautions anyone could use your PC to sign a message or document while your back is turned

A document can be signed by many different signatures, so you can use the feature just as you would manual signatures and counter-signatures on a document: you write a document, sign it and send it to your boss; if they’re happy with it, they sign it and send it to their boss, who signs it and passes it on to whoever it is who needs to know that this document has been approved by two levels of management. Digital Signatures are applied to a document through Tools | Options… | Security | Digital Signatures. In Outlook, you’d choose View | Options… | Security Settings… on a new message before it’s sent.

If anyone attempts to modify a signed document or message, the signatures are automatically removed. If they try to make a change to the signed document surreptitiously, the signature would no longer match the contents of the document and would be marked as such. Documents with signatures usually show a red rosette on the status bar and the word ‘Signed’ next to the document name on the title bar of the window. Certificates can be generated by a corporate IT department or bought from a third-party firm such as VeriSign or Thawte.

Be aware that none of these precautions will stop a really determined forger and that more severe secrecy measures such as the Information Rights Management features built into Office 2003 come with a heavy price, like the need to keep a dedicated key server computer available to all recipients and all computers running a special, secure version of Windows.