Organizations that produce and sell original works in the digital sphere should ensure they have adaquete tools for implementing Digital Rights Management (DRM) to protect them from unauthorized use and proliferation.

Control Type: Technical

Control Function: Preventive/Deterrent

Protects: Integrity

Digital Rights Management (DRM) or Information Rights Management (IRM) is the management of information in accordance with who has rights to it. It involves using technical controls in tandem with an organization’s other access control methods to protect specific data types at the file level. Most commonly, DRM is used to protect Intellectual Property (IP).

Common forms of IP often protected with DRM are:

  • Copyright: legal protection for expressions of ideas. Movies, music, video games, books, and other creative/informative works fall under this umbrella. Copyright places overall control over the proliferation of works with the owners. The entities that own the copyright are the ones legally allowed to profit from the work, make copies of it, sell it, and perform it in public. However, there are exceptions to this in many cases, such as Fair Use, which allows using copyrighted materials in academia, critiques, reporting, research, and satire. The specifics of copyright laws vary from jurisdiction to jurisdiction.
  • Trademarks: legal protection applied to specific words, slogans, logos, mascots, and other small expressions that uniquely represent an organization’s brand. Trademarks in the US are registered with the US Patent and Trademark Office (USPTO) and are meant to protect the public image an organization has.
  • Patents: legal protection for inventions, processes, materials, and other creations. Patent owners secure the rights to produce, sell, and import their creations. Patents can be recognized internationally if the creator applies to the World Intellectual Property Office (WIPO) and is approved. The WIPO is under the Patent Cooperation Treaty which has 152 member nations.
  • Trade Secrets: one of the most valuable pieces of data in an organization, trade secrets are like patents, encompassing a variety of creations by the organization, such as formulas, processes, and insightful research. Trade secrets need stable data protection at the Secret/Confidential level to prevent leakage and potential business damage.

Organizations can use DRM tools to protect any of these forms of digital property. For organizations that specialize in any kind of creative work, having a DRM tool is a must. Tools protect digital property using labels and metadata attached to the finished products. The actual methods the tools use can depend. Some of the most common are:

  • Rudimentary Reference Checks: an older method that involves DRM protected software requiring the end user to enter in specific information before proceeding. This information is something the user will only know if they purchase a legitimate copy of the software.
  • Online Reference Checks: the same idea as the first option; involves the user entering in a unique identifier, such as a product key before access to the software is granted. The program connects back to a company database out on the Internet to validate the product key’s authenticity.
  • Local Agent Checks: common in gaming software, this approach involves the user installing a program that checks the protected software against the license provided on behalf of the software manufacturer. Think of programs like Steam and EA.
  • Present Media: another older approach common in XP era video games, this approach requires a valid piece of media from the manufacturer, such as a CD, to be present while the software is in use. The media has the DRM tool embedded in it to validate the installation’s authenticity.
  • Support-Based Licensing: some modern programs check whether installations are valid before providing any updates/patches. If the user cannot account for proper licensing, they will be shut out of updates, rendering the program unusable over time.

DRM can be a complex beast that requires a clear understanding of the laws and tools used to implement it. Organizations that specialize in providing original digital work should ensure they have a clear process for protecting those works. This includes acquiring the necessary legal protections for the work, and properly implementing the digital protection.