Securing PDFs with passwords. Adobe ACROBAT XI

Security

Specify privileged locations for trusted content

Enhanced security provides a way to specify locations for trusted content. These privileged locations can be single files, folders, or host domains (root URLs). Content that resides in a privileged location is trusted. For example, enhanced security normally blocks PDFs from loading data from unknown websites. If you add the data’s origin (its host domain) to your list of privileged locations, Acrobat and Reader allow loading the data. For details, see the Enhanced Security document at www.adobe.com/go/learn_acr_appsecurity_en .

1

2

Select Preferences > Security (Enhanced).

3

Select the Enable Enhanced Security option.

Specify a list of locations in the Privileged Locations section, and then click OK.

• To trust any sites you already trust in Internet Explorer, select Automatically Trust Sites From My Win OS

Security Zones.

• To add only one or two PDFs from a location, click Add File.

• To create a trusted folder for multiple PDFs, click Add Folder Path or Add Host.

• To allow data to load from a website, enter the name of the root URL. For example, enter www.adobe.com, but not www.adobe.com/products. To trust files from secure connections only, select Secure Connections Only

(https:).

Cross-domain access

Enhanced security prevents a PDF in one host domain from communicating with another domain. This action prevents a PDF from getting malicious data from an untrusted source. When a PDF attempts cross-domain access, Acrobat and

Reader automatically attempt to load a policy file from that domain. If the domain of the document that is attempting to access the data is included in the policy file, then the data is automatically accessible.

For more details, see the Application Security Guide at www.adobe.com/go/learn_acr_appsecurity_en .

353

Securing PDFs with passwords

Password security and restricting printing, editing, and copying

Note: For a full list of articles about security, see Overview of security in Acrobat and PDF content .

You can limit access to a PDF by setting passwords and by restricting certain features, such as printing and editing.

However, you cannot restrict saving copies of a PDF. The copies have the same restrictions as the original PDF. Two types of passwords are available:

Document open password

A Document Open password (also known as a user password) requires a user to type a password to open the PDF.

Permissions password

A permissions password (also known as a master password) requires a password to change permission settings. Using a permissions password, you can restrict printing, editing, and copying content in the PDF.

Recipients don’t need a password to open the document in Reader or Acrobat. They do need a password to change the restrictions you've set.

Last updated 1/14/2015

Security

If the PDF is secured with both types of passwords, it can be opened with either password. However, only the permissions password allows the user to change the restricted features. Because of the added security, setting both types of passwords is often beneficial.

Note: You cannot add passwords to a signed or certified document.

Add a password to a PDF

You can add password security to a PDF. To open the PDF, the user must enter a password.

1

Open the PDF and choose Tools > Protection > Encrypt > Encrypt with Password. (If the Protection panel is not visible, choose View > Tools > Protection.)

To apply protection to a PDF Portfolio, first open the PDF Portfolio and choose View > Portfolio > Cover Sheet.

Then choose Tools > Protection > Encrypt > Encrypt With Password.

Note: If these options are unavailable, it’s either because the document or PDF Portfolio already includes security settings, was signed with a certificate-based signature, or was created in LiveCycle Designer ES.

2

If you receive a prompt, click Yes to change the security.

3

Select Require A Password To Open The Document, then type the password in the corresponding field. For each keystroke, the password strength meter evaluates your password and indicates the password strength using color patterns.

354

4

Select an Acrobat version from the Compatibility menu. Choose a version equal to or lower than the recipients’ version of Acrobat or Reader. The Compatibility option you choose determines the type of encryption used. It is important to choose a version compatible with the recipient's version of Acrobat or Reader. For example, Acrobat 7 cannot open a PDF encrypted for Acrobat X and later.

• Acrobat 6.0 And Later (PDF 1.5) encrypts the document using 128-bit RC4.

• Acrobat 7.0 And Later (PDF 1.6) encrypts the document using the AES encryption algorithm with a 128-bit key size.

• Acrobat X And Later (PDF 1.7) encrypts the document using 256-bit AES. To apply 256-bit AES encryption to documents created in Acrobat 8 and 9, select Acrobat X And Later.

5

Select an encryption option:

Encrypt All Document Contents

Encrypts the document and the document metadata. If this option is selected, search engines cannot access the document metadata.

Last updated 1/14/2015

Security

Encrypt All Document Contents Except Metadata

Encrypts the contents of a document but still allows search engines access to the document metadata.

Note: The iFilter and the Find or Advance Search commands of Acrobat do not look into the PDF’s metadata even when you select the Encrypt All Document Contents Except Metadata option. You can use a search tool that takes advantage of XMP metadata.

Encrypt Only File Attachments

Requires a password to open file attachments. Users can open the document without a password. Use this option to create security envelopes.

6

Click OK. At the prompt to confirm the password, retype the appropriate password in the box and click OK.

Restrict editing of a PDF

You can prevent users from changing PDFs. The Restrict Editing option prohibits users from editing text, moving objects, or adding form fields. Users can still fill in form fields, sign, or add comments.

1

Open the PDF and choose Tools > Protection > Restrict Editing. (If the Protection panel is not visible, choose View

> Tools > Protection.)

To restrict editing of a PDF Portfolio, first open the PDF Portfolio to the cover sheet (View > Portfolio > Cover

Sheet). Then choose Tools > Protection > Restrict Editing.

Note: If these options are unavailable, it’s either because the document or PDF Portfolio already includes security settings, was signed with a certificate-based signature, or was created in LiveCycle Designer ES.

2

Type the password in the corresponding field. For each keystroke, the password strength meter evaluates your password and indicates the password strength using color patterns.

355

3

Click OK, and then save the PDF to apply the restrictions.

Restrict printing, editing, and copying

You can prevent users from printing, editing, or copying content in a PDF. You can set the restrictions you want to apply to the PDF. You change these restrictions only if you know the permissions password.

Illustrator, Photoshop, or InDesign, do not have view-only modes. To open a restricted PDF in these applications, the user must enter the permissions password.

1

Open the PDF and choose Tools > Protection > Encrypt > Encrypt with Password. (If the Protection panel is not visible, choose View > Tools > Protection.)

To add restrictions to a PDF Portfolio, first open the PDF Portfolio and choose View > Portfolio > Cover Sheet. Then choose Tools > Protection > Encrypt > Encrypt With Password.

Last updated 1/14/2015

Security

Note: If these options are unavailable, it’s either because the document or PDF Portfolio already includes security settings, was signed with a certificate-based signature, or was created in LiveCycle Designer ES.

2

3

If you receive a prompt, click Yes to change the security.

Select Restrict Editing And Printing Of The Document.

All Adobe products enforce the restrictions set by the permissions password. However, if third-party products do not support these settings, document recipients are able to bypass some or all of the restrictions you set.

4

Type the password in the corresponding field. For each keystroke, the password strength meter evaluates your password and indicates the password strength using color patterns.

356

5

Select what the user can print from the Printing Allowed menu:

None

Prevents users from printing the document.

Low Resolution (150 dpi)

Lets users print at no higher than 150-dpi resolution. Printing may be slower because each page is printed as a bitmap image. This option is available only if the Compatibility option is set to Acrobat 5 (PDF

1.4) or later.

High Resolution

Lets users print at any resolution, directing high-quality vector output to PostScript and other printers that support advanced high-quality printing features.

6

Select what the user can change from the Changes Allowed menu:

None

Prevents users from making any changes to the document that are listed in the Changes Allowed menu, such as filling in form fields and adding comments.

Inserting, Deleting, And Rotating Pages

Lets users insert, delete, and rotate pages, and create bookmarks and thumbnails. This option is only available for high (128-bit RC4 or AES) encryption.

Filling In Form Fields And Signing Existing Signature Fields

Lets users fill in forms and add digital signatures. This option doesn’t allow them to add comments or create form fields. This option is only available for high (128-bit RC4 or AES) encryption.

Commenting, Filling In Form Fields, And Signing Existing Signature Fields

Lets users add comments and digital signatures, and fill in forms. This option doesn’t allow users to move page objects or create form fields.

Any Except Extracting Pages

Lets users edit the document, create and fill in form fields, and add comments and digital signatures.

7

Choose any of the following options:

Enable Copying Of Text, Images, And Other Content

Lets users select and copy the contents of a PDF.

Enable Text Access For Screen Reader Devices For The Visually Impaired

Lets visually impaired users read the document with screen readers, but doesn’t allow users to copy or extract the document’s contents. This option is available only for high (128-bit RC4 or AES) encryption.

Last updated 1/14/2015

Security

8

Select an Acrobat version from the Compatibility menu. Choose a version equal to or lower than the recipients’ version of Acrobat or Reader. The Compatibility option you choose determines the type of encryption used. It is important to choose a version compatible with the recipient's version of Acrobat or Reader. For example, Acrobat 7 cannot open a PDF encrypted for Acrobat X and later.

357

• Acrobat 6.0 And Later (PDF 1.5) encrypts the document using 128-bit RC4.

• Acrobat 7.0 And Later (PDF 1.6) encrypts the document using the AES encryption algorithm with a 128-bit key size.

• Acrobat X And Later (PDF 1.7) encrypts the document using 256-bit AES. To apply 256-bit AES encryption to documents created in Acrobat 8 and 9, select Acrobat X And Later.

9

Select what you want to encrypt:

Encrypt All Document Contents

Encrypts the document and the document metadata. If this option is selected, search engines cannot access the document metadata.

Encrypt All Document Contents Except Metadata

Encrypts the contents of a document but still allows search engines access to the document metadata.

Note: The iFilter and the Find or Advance Search commands of Acrobat do not look into the PDF’s metadata even when you select the Encrypt All Document Contents Except Metadata option. You can use a search tool that takes advantage of XMP metadata.

Encrypt Only File Attachments

Requires a password to open file attachments. Users can open the document without a password. Use this option to create security envelopes.

10

Click OK. At the prompt to confirm the password, retype the appropriate password in the box and click OK.

Note: If you forget a password, you cannot recover it from the PDF. Consider keeping a backup copy of the PDF that isn’t password-protected.

Remove password security

You can remove security from an open PDF if you have the permissions to do so. If the PDF is secured with a serverbased security policy, only the policy author or a server administrator can change it.

1

Open the PDF, then select Tools > Protection > Encrypt > Remove Security.

2

Your options vary depending on the type of password security attached to the document:

• If the document had only a Document Open password, click OK to remove it from the document.

• If the document had a permissions password, type it in the Enter Password box, and then click OK. Click OK again to confirm the action.

Last updated 1/14/2015

Security

Opening secured PDFs

Note: For a full list of articles about security, see Overview of security in Acrobat and PDF content .

Acrobat and Reader warn you any time you try to open a URL (website) or a file attachment that uses a disallowed file type. URLs and disallowed file types are potentially dangerous because they can transfer or run programs, macros, or viruses that can damage your computer. Examples of disallowed file types include .exe and .zip files.

Documents can be secured in several ways. To view the security settings of a document, choose File > Properties in

Acrobat or Reader. From the Document Properties dialog box, click the Security tab. If you have trouble opening a PDF, or you’re restricted from using certain features, contact the author of the PDF.

Password protected

A password-protected PDF either requires a password to open or a password to change or remove restricted operations. If a document has restricted features, tools and options related to those features are dimmed.

Certified

Certifying a document assures recipients that the document is authentic. Certifying signatures also include information to allow or disallow particular actions, such as filling forms and modifying the document. When you submit a certified form, you are assured that it is going back to the valid author. A document with a valid certificate displays a Blue Ribbon icon . A PDF Portfolio with a valid certificate displays a Signature Badge.

358

Adobe LiveCycleRights Management ES configured

Adobe LiveCycleRights Management ES (ALCRMS) lets you manage accounts and configure security policies for your organization. ALCRMS lets you apply a policy to documents without the need for digital signatures and certificates.

More Help topics

About Certificate signatures | Digital signatures

Securing documents with passwords

Certificate security

Setting up security policies for PDFs

Note: For a full list of articles about security, see Overview of security in Acrobat and PDF content .

Types of security policies

If you often apply the same security settings to multiple PDFs, you can save your settings as a policy that you can reuse.

Security policies save time while ensuring a consistently secure workflow. Creating policies for password and certificate security lets you reuse the same security settings for any number of PDFs. Two kinds of security policies are available:

• Organizational policies are especially useful if you want others to have access to PDFs for a limited time. Adobe

LiveCycleRights Management ES policies are stored on a server. Users must have access to the server to use these policies. Creating these policies requires specifying the document recipients from a list on Adobe LiveCycleRights

Management ES. Adobe LiveCycleRights Management ES controls access to PDFs and auditing events as defined by the security policy. You can use Adobe LiveCycleRights Management ES if your company has licensed the software and made it available to you.

Last updated 1/14/2015

Security

• User policies are created and applied by individuals. If you apply the same security settings to numerous documents, you can save time by creating a user policy. Then, apply the user policy to documents. User policies for passwords and public key certificates are stored on your local computer. With access to Adobe LiveCycleRights Management

ES, you can create a user policy that’s stored on Adobe LiveCycleRights Management ES. That policy is available only to you.

How organizational policies are authenticated

In addition to reusing security settings, policies stored on Adobe LiveCycleRights Management ES enable you to expire and revoke documents. You can also maintain accountability by auditing users who open protected documents.

359

A Policies are stored on server. B Policies are applied to a PDF. C Users can open, edit, and print a document only if permitted by policy.

Setting up server-based security policies involves four main stages:

Configure the Adobe LiveCycleRights Management ES

The system administrator of your company or group usually configures Adobe LiveCycleRights Management ES, manages accounts, and sets up organizational policies. For more information on configuringAdobe LiveCycleRights Management ES, see the Adobe website.

Publish a document with a security policy

An author creates a PDF and applies a policy stored on Adobe LiveCycle

Rights Management ES to the PDF. The server generates a license and unique encryption key for the PDF. Acrobat embeds the license in the PDF and encrypts it using the encryption key. The author or administrator can use this license to track and audit the PDF.

View a document with a policy applied

When users try to open the secure PDF in Acrobat 9 (or Reader 9), they must authenticate their identities. If the user is granted access to the PDF, the PDF is decrypted and opens with the permissions specified in the policy.

Administer events and modify access

By logging in to an Adobe LiveCycleRights Management ES account, the author or administrator can track events and change access to policy-secured PDFs. Administrators can view all PDF and system events, modify configuration settings, and change access to policy-secured PDFs.

Create a user security policy

User policies can use passwords, certificates, or Adobe LiveCycleRights Management ES to authenticate documents.

The policies for password and certificate security can be stored on a local computer. Security policies created using

Adobe LiveCycleRights Management ES are stored on a server. You can audit actions and change security settings dynamically. You can use Adobe LiveCycleRights Management ES if your company has licensed the software and made it available to you.

Create a password policy

In Acrobat, choose Tools > Protection > Encrypt > Manage Security Policies. If you don’t see the Protection panel, see

the instructions for adding panels at Task panes .

Last updated 1/14/2015

Security

1

Click New.

2

3

Select Use Passwords, and then click Next.

Type a name and description for the policy, do one of the following, and then click Next:

• To specify passwords and restrictions whenever you apply this policy to a document, clear the Save Passwords

With The Policy option.

• To save passwords and restriction settings with the policy, select Save Passwords With The Policy.

4

Specify a compatibility setting and password options. If you selected Save Passwords With The Policy, specify the password and restrictions. Click OK.

5

Review the policy details, click Finish, and then click Close.

Create a certificate policy

In Acrobat, choose Tools > Protection > Encrypt > Manage Security Policies. If you don’t see the Protection panel, see

the instructions for adding panels at Task panes .

1

Click New.

2

3

Select Use Public Key Certificates, and then click Next.

Type a name and description for the policy, and specify the document components to encrypt.

Certificates must be current and have key usage that allows for encryption.

4

Determine how to enforce the policy:

• To create a policy that is associated with individual recipients, do not select Ask For Recipients When Applying

This Policy.

• To create a policy that is associated with individual documents, select Ask For Recipients When Applying This

Policy.

5

Select an encryption algorithm from the menu that is compatible with the recipients’ version of Acrobat, and click

Next.

6

Do one of the following:

• If you selected Ask For Recipients When Applying This Policy, review the policy settings and then click Finish.

• If you did not select Ask For Recipients When Applying This Policy, specify recipients by selecting digital IDs

(including your digital ID). Then click Next.

7

Click Finish.

Creating policies for secure file attachments

You can add security to one or more documents by embedding them in a security envelope and sending it as an email attachment. This method is useful if you want to send a secure file attachment without encrypting the files. You can embed the documents as file attachments in a security envelope, and encrypt and send the envelope to the recipients.

When the recipients open the envelope, they can extract the file attachments and save them. The saved files are identical to the original file attachments and are no longer encrypted when saved.

For example, when you send confidential documents, including non-PDF files, you only want the recipient to view the documents. You can embed these documents as attachments in a security envelope, encrypt the envelope, and send it by email. Anyone can open the envelope, view its cover page, and even view a list of the contents. However, only the recipient can view the embedded attachments and extract them.

360

Last updated 1/14/2015

Security

Choose Tools > Protection > More Protection > Create Security Envelope. If you don’t see the Protection panel, see the instructions for adding panels at

Task panes .

1

2

Click Add File To Send, select the documents you want to attach, and then click Open. Click Next.

Select an envelope template, and click Next.

5

6

3

4

Select a delivery method, and click Next.

If an envelope policy has been created, select it or select New Policy. Then, follow the steps to create a policy.

Review the information and click Finish.

For some policies, you are asked to type the information you want displayed on the envelope. Enter enough information to allow recipients to identify the sender of the envelope.

7

Complete the security information (password, certificate, or policy).

8

When the envelope is displayed, type the names of the recipients. Then, either click the Save or Mail icon in the toolbar.

If you click the Mail icon, your default email program opens with the security envelope as an attachment. Type the email addresses of the recipients, and send the email message.

Create a user security policy with Adobe LiveCycle Rights Management ES

If you have access to Adobe LiveCycle Rights Management ES, you can restrict document access and rights of individuals registered with the server. When you create a user policy usingAdobe LiveCycleRights Management ES, you’re redirected to the AdobeLiveCycle Rights Management ES web page.

1

Do one of the following:

• For a single PDF or a component PDF in a PDF Portfolio, open the PDF.

• For a PDF Portfolio, open the PDF Portfolio and choose View > Portfolio > Cover Sheet.

Choose Tools > Protection > Encrypt > Manage. If you don’t see the Protection panel, see the instructions for adding panels at

Task panes .

2

Click New.

7

8

5

6

3

4

Select Use The Adobe LiveCycleRights Management, and click Next.

On the Adobe LiveCycleRights Management web page, click Policies, and then click New.

Type a name and description, set the validity period, and any other options.

Select the users or groups, set permissions for them, and click OK.

Specify the document components you want to encrypt, and whether you want a watermark.

When you’re done, click Save at the top of the page.

Last updated 1/14/2015

361

Security

Apply security policies to PDFs

You can apply either an organization policy or a user policy to a PDF. To apply a server policy to a document, connect to Adobe LiveCycleRights Management ES. Adobe LiveCycleRights Management security policies must be stored on a server, but PDFs to which the policies are applied need not. You can apply policies to PDFs using Acrobat, server-side batch sequences, or other applications, such as Microsoft Outlook.

Only the policy administrator can edit or remove organizational policies. For details on editing security policies, choose

Tools > Protection > More Protection > Rights Management > Manage Account. Then click Help in the upper-right corner.

Apply a security policy to a PDF

1

Do one of the following:

• For a single PDF or a component PDF in a PDF Portfolio, open the PDF.

• For a PDF Portfolio, open the PDF Portfolio and choose View > Portfolio > Cover Sheet.

2

If you are using a server policy, choose Tools > Protection > Encrypt > Manage Security Policies. Select a policy.

Choose an Adobe LiveCycleRights Management policy from the list and then click Refresh.

Refreshing security policies ensures that you get the most up-to-date server policies.

Choose Tools > Protection > Encrypt > Manage Security Policies. Select a policy, and then click Apply To Document.

If you don’t see the Protection panel, see the instructions for adding panels at

Task panes .

Apply a policy to attachments in Outlook

You can send different types of files as secure PDF attachments in Microsoft Outlook. This option is available only if

Adobe LiveCycleRights Management ES is set up and available in Acrobat.

3

4

1

2

In Outlook, choose New Mail Message on the Home ribbon.

Click the Attach As Secured Adobe PDF button on the Adobe PDF ribbon.

Select the file you want to attach by typing the file path or by clicking Browse.

Specify how you want to secure the document, and click OK.

The file is converted to PDF and encrypted using the security method you choose.

5

Complete the email message, and then click Send.

Remove a user security policy from a PDF

You can remove a security policy from a PDF if you have appropriate permissions. In general, a document owner can remove a security policy from a PDF.

1

Do one of the following:

• For a single PDF or a component PDF in a PDF Portfolio, open the PDF.

• For a PDF Portfolio, open the PDF Portfolio and choose View > Portfolio > Cover Sheet.

Select Tools > Protection > Encrypt > Remove Security. If you don’t see the Protection panel, see the instructions for adding panels at

Task panes

.

Export security settings

1

Choose Preferences > Security > Export.

2

Choose which groups of settings you want to share and click OK.

Last updated 1/14/2015

362

Security

3

Review and modify the security settings as needed, and then click Export.

4

5

Select the method to use to encrypt the security settings (if desired), and then click OK.

Choose Recipients and click OK twice.

Sign the file.

Copy, edit, or delete a policy

1

Choose Tools > Protection > Encrypt > Manage Security Settings. If you don’t see the Protection panel, see the instructions for adding panels at

Task panes .

2

From the Show menu, choose whether you want to display all policies that you have access to, user policies that you’ve created, or organizational policies.

3

Select a policy, and then use the options you want:

Note: Options to edit or delete organizational policies aren’t available unless you have administrator rights to Adobe

LiveCycleRights Management ES. Changes to these policies can be made only on Adobe LiveCycleRights Management

ES, which opens automatically when you select an option.

Copy

Use to create a policy that’s based on the settings of an existing policy.

Edit

Editing a user policy that is stored on a local computer affects only documents to which the policy is applied after the policy is edited. For user policies stored on a server, you can edit the permission settings and other options.

This option isn’t available for organizational policies.

Delete

This option is not available usually for organizational policies.

Favorite

If this option is selected, a star appears next to the policy. To remove a policy from the favorites, click

Favorite again. You can apply the Favorite option to multiple policies. Use this option to make a policy easier to retrieve.

Revoke a policy-protected PDF

To restrict access to a policy-protected PDF that you made available to a group of users, you can revoke the document.

1

Do one of the following:

• For a single PDF or a component PDF in a PDF Portfolio, open the PDF and log in to Adobe LiveCycle Rights

Management ES.

• For a PDF Portfolio, open the PDF Portfolio, log in to Adobe LiveCycleRights Management, and choose View >

Portfolio > Cover Sheet.

2

Choose Tools > Protection > More Protection > Rights Management > Revoke. If you don’t see the Protection panel, see the instructions for adding panels at

Task panes .

3

From the menu on the web page, choose an option that explains why you’re revoking the document, or type a message. If you’re replacing the revoked document, type the URL location of the new document.

4

Click OK to save your changes.

More Help topics

Securing documents with certificates

Securing documents with passwords

363

Last updated 1/14/2015