• IRM - Information Rights Management
  
• DRM - Digital Rights Management
  
• EDRM - Enterprise Digital Rights Management
  
• ERM - Enterprise Rights Management
  
• RMS - Rights Management Services, specific to the Microsoft IRM technology
  

Whilst at first glance it might seem like all of these technologies do the same thing, DRM is the odd one out and the others can be grouped together. In the early days IRM technologies were initially labeled as ERM in an attempt to separate them from DRM, the term IRM came later as the market matured. For simplicity sake in this article, technologies such as ERM, EDRM and RMS will be discussed under the acronym IRM unless specifically mentioned.

What is the difference between DRM and IRM?

• DRM refers to technologies that control access to common media formats, such as music, video and digitally published material (e.g. high value financial analysis reports)
• IRM refers to technologies which control access to enterprise generated content, such as engineering intellectual property, HR documents, patient health records, company financial reports, sensitive email communication
• Most enterprise based technologies (although not Oracle IRM) were developed from either an existing DRM technology, or at least from the same ideals and methods

The first two points are very important with regards to how the technologies are perceived by end users and the main goal for the implementation of the technology. Consider the following scenarios.

1. You purchase a favorite song in a digital form and download to your computer. You want to play this song on both your laptop, mp3 player and also in your home CD player. Yet due to a technology used by the retailer that sold you the song, you can only play the music on a limited number of devices.

2. Your doctor stores your health information on his laptop inside documents that are encrypted and use rights controls to ensure only your doctor and authorized medical staff can open them.

DRM applies to the first situation and consumers are typically unhappy that technology is trying to dictate what they can do with content they've purchased. People are used to playing their music on a variety of devices and want to copy the information to whatever device they wish. DRM is typically about protecting the rights of the content owner from being abused, the consumer of that information doesn't necessarily care about the mis-use of the content. This has led to a constant battle between DRM technologies and the users, with thousands trying to break/hack the DRM so they can use content as they wish.

IRM however addresses a very different issue. It is about helping businesses keep secrets a secret. That information might be your health records, your personal HR data at your place of work, it might be the intellectual property your company owns which allow it to keep ahead of the competition and keep you employed. End users have a very different view of IRM, they want to use it, it helps protect them and their companies data.

So DRM focuses mainly on protecting business to consumer type content, where IRM focuses on enterprise content. This is important because it drives the technology in different ways. For instance, consider the following.

DRM protects a single file which is to only be opened by the purchaser, so the rights are embedded and delivered with the file. This works in a DRM model, because you want only the end user to access the content.

IRM typically is used in different scenarios, such as;

IRM protects a single file which is to be opened by 500 sales employees. After 6 months, 1/2 of the employees leave the company taking a copy of the file with them and another 250 people are hired. Of these people, 15 were promoted to manager and their rights to the document is increased so they are allowed to print copies.

To support the above you can't store any rights specific information in the document itself because the rights do change over time. You need to have a way to change rights to the document with having to re-distribute it. Oracle IRM does this by separating the rights from the content. Oracle IRM has, from day one, kept all rights information outside the file itself and on the network server. Access and rights are granted at the point when the document is opened. Locally cached rights, an authenticated user and the encrypted document, all come together at once.

Other IRM technologies have been developed from DRM technologies or they have used the same design methods. This is what prevents them from being truly enterprise scalable.

Finally, IRM can be used to solve some DRM problems. Oracle IRM has been successfully implemented by publishers to protect high value content in PDF documents. This is a classic business to consumer model but Oracle IRM, due to it's scalable and more effective implementation of encryption, works and can deliver an effective solution.

Sealed Solutions are a leading provider of Oracle IRM services in Germany and the partnership with Outpost24 will increase their ability to fulfill major GRC (Governance, Risk and Compliance) requirements with vulnerability assessment and management best practices to ensure the protecting and handling of customer's confidential information and data.

Norbert Bacher, CEO Sealed Solutions GmbH, was quoted as saying, "With the technology provided by Outpost24, we are now able to secure and protect not only confidential e-mails and other sensitive information like we do with our Information Rights Management solutions, but are pleased to now be able to protect our customer's organizational centerpiece - 'the network'. Both from the inside, as well as the outside. Outpost24's Vulnerability Management solutions are an excellent complement to our current Information Rights, Security and GRC solutions."

To protect a sensitive document from unauthorized access and modification, all you need to do is seal it to the relevant context. Once sealed, the document is protected by the rights defined for the context.

For example, sealing the board minutes to the sensitive board communication context, as shown above, might ensure that the minutes are accessible only to the board members and their personal assistants. To simplify the assignment of different rights to different users, each context contains roles such as Contributor, Reviewer, and Reader. A particular user might be a Contributor in sensitive board communication and a Reader in confidential engineering research.

Contexts and Security

Contexts and Usability

Contexts and Manageability

By avoiding the need to manage and propagate the rights to thousands of individual documents, the solution can scale to meet the needs of even the largest enterprise. Finally, contexts enable policy changes to be applied at any time to thousands of documents - regardless of where those documents are. Rights can be assigned and unassigned as required without having to locate and modify each of the documents.

Standard Roles for Enterprise Rights Management

Each role defines a set of rights that are appropriate to that role. For example, a Contributor has the right to create and edit sensitive documents, whereas a Reviewer can only edit existing documents and change tracking is enforced. These roles are then assigned to users for particular workflows and information classifications. Commonly these assignments are done by group membership inside your corporate user directory. So by simply adding a user to one or more groups in say Active Directory would immediately give them access to thousands documents secured against those classifications, and vice versa, they leave the organization and their account is deleted from Active Directory, all the documents they had copied to their USB device are now useless.

Where necessary, the standard roles can be tailored or extended, but Oracle has used the experience gained from numerous enterprise deployments to provide a set of roles that meet the needs of most clients. So what are the standard roles and what do they allow users to do?

Standard Roles Overview

Contributors are the people who are authorized to create and edit documents in a particular context. They can open and search and print documents that are sealed to the context. Reviewers are authorized to edit sealed documents and email, but change tracking is enforced. They can also open and search and print sealed documents and email but are not authorized to create new sealed documents or email - they can only review or reply to documents and email created by Contributors. The Reader role allows opening, searching and printing of sealed documents but they cannot create or edit. The Reader (no print) is the same except they obviously have no rights to print.

Finally Item Readers are authorized to open and search particular sealed documents. This allows for people to be added to contexts which contain large amounts of protected information and yet they can only open a few identified documents. This role is designed to be the exception to the rules defined by all the contexts on the system, otherwise it managing lists of users rights to specific documents becomes quickly unmanageable.

Oracle also recognizes the need to control access to these roles so that they are assigned appropriately. Oracle IRM therefore defines standardized administrative roles, the most significant being:

Context Owners are authorized to assign roles, and are typically the owners of confidential information and work flows. System Owners are authorized to create new contexts and make the initial assignment of the Context Owner role. Their involvement in a particular context might end soon after that initial assignment.

If you want to learn more about Oracle IRM, please have a look at our simple online demo or contact us for a more in depth evaluation.