First there was the ”dodgy dossier” that the British government published as a Word document, complete with the history of who changed what. Now it seems the United States Transportation Security Administration is distributing its infamous No-Fly list — the names of roughly 1 000 people who are deemed ”threats to aviation” and not allowed on planes under any circumstances — to airports as an Excel spreadsheet protected by just a password.
Passwords for desktop applications such as Office can be easily cracked with tools that are widely available. That is handy if you forget the password you used to lock your documents. It is not so good if you are trying to protect confidential data. And while a spreadsheet is easy to create and guaranteed to open on almost any PC, it is rarely the best place to keep important data.
Tony Speakman, of database company FileMaker, says: ”A spreadsheet is like a disposable razor — it’s fine if you are only using the data once. If you are going to use it as an ongoing part of the business, if the data is being re-used and analysed and shared among different people, a spreadsheet is no longer appropriate.”
When you put information in a spreadsheet, you only have one view of it. Anyone with access to the document can see it all, and can often change it, too. With a database, you can create different views of the same information. The accounts department needs to see how much you are paying for supplies, but the size of the boxes isn’t relevant. The warehouse, by contrast, doesn’t care much about the price, only when it is arriving and how much space it will take up. If you need to send information outside the company, you can create a run-time version of the database so the information can’t be changed or exported.
It is possible to password-protect sections of a spreadsheet to restrict who can see what, but it is a lot of effort, so people usually save the relevant information as a separate document to send on. This results in multiple versions of information, making it harder to keep everything up to date — and secure.
Nigel Beighton, of Symantec, points out that desktop PCs with second-generation copies of data files are seldom as well protected as the server with the original information. ”We need to educate users to destroy temporary data after use,” he says.
One way to do that is to use the Information Rights Management (IRM) features in Office 2003. Microsoft is keen to point out that this isn’t strictly speaking a security feature because there are ways to get around some of the restrictions, but it will stop people copying, forwarding or editing confidential documents by accident. And you can set expiry dates on documents to make sure you are always working with an up-to-date version of your customer list.
To be really secure you need to encrypt files with something stronger than the Office password option. If a file is not leaving your PC you can use the encryption built into XP’s NTFS file system. This works transparently: as long as you have access to a protected file, you will never need to worry that it is encrypted.
PGP (Pretty Good Privacy), which is often used to encrypt e-mail, can also be used to protect files and folders, both on your PC and when you send them on.
Cryptographer Bruce Schneier says it is the ”closest you are likely to get to military-grade encryption”. You can download the freeware version or get a simpler interface, as well as encrypted instant messages, with the new PGP Desktop Professional 9.
If sticking with Office passwords for simplicity — or you have an Office document with a forgotten password — remember that the older your version of Office, the easier it is to get past passwords.
Office 95 and 97 passwords can often be cracked in a few minutes. Office 2000 and XP have better encryption, but the applications default to less secure encryption for backward compatibility.
You also need to choose the right protection option. Using the Protect Workbook setting in Excel stops anyone changing worksheets, but if you copy hidden cells to a new spreadsheet, they will be visible.
Office 2003 has the strongest encryption options, but using it means you can only open the documents in another copy of Office 2003. This uses Windows’ built-in cryptography, so the encryption depends on which version of Windows is installed.
When distributing password-protected Office documents, it is important to change the password with every version, because the stream cipher used to encrypt the document is always the same for any particular file. If you don’t, a hacker with two versions of the document has a head start on cracking it.
The longer and more complex the password, the harder it is to break. However, the more expensive recovery tools such as Paraben’s Decryption Collection Enterprise use a range of approaches including dictionary and brute force attacks. Paraben includes tools to recover passwords for a wide range of applications from Office, Lotus, WordPerfect, Exchange, Acrobat, WinZip, Quicken and MYOB to Outlook Express.
Passware has individual tools for a similar range of programs. There is even an online recovery service for Word and Excel documents at www.decryptum.com that will give you a preview of the contents before you pay to unlock the file. – Guardian Unlimited Â