| Your first step toward a secure Office environment involves securing your documents. Office 2003 offers a number of security levels, which range from merely suggesting that users don't edit a file to requiring strong passwords to open otherwise-encrypted documents. The next few sections take you through some of these document security options. Preventing Changes by Opening a Document as Read-Only One way to prevent unauthorized changes to a document is to open it as read-only. You can still make changes to the document, but you can't save those changes (except to a different file). If you're opening the file yourself, you can open it as read-only by following these steps: 1. | Select File, Open (or press Ctrl+O) to display the Open dialog box.
| 2. | Open the folder containing the document and then select the document.
| 3. | Pull down the Open list and click Open Read-Only, as shown in Figure 14.1.
Figure 14.1. To open a document as read-only, pull down the Open list and click Open Read-Only. 
|
As an extra measure of safety, you can also tell Word and Excel to recommend that a document be opened as read-only. Select File, Save As to open the Save As dialog box, and then use the following techniques: In Word, select Tools, Security Options, activate the Read-Only Recommended check box, and then click OK. In Excel, select Tools, General Options, activate the Read-Only Recommended check box, and then click OK.
Click Save to finish saving the document. A More Direct Route Rather than using the Save As dialog box, you can set the read-only recommendation directly. In Word and Excel, select Tools, Options, display the Security tab, and then activate the Read-Only Recommended check box. |
When you attempt to open the document now, Word or Excel displays a dialog box similar to the one shown in Figure 14.2. Click Yes to open the document as read-only; click No if you want to make changes to the document. Figure 14.2. With the Read-Only Recommended check box activated, Word or Excel displays this dialog box before opening the document. 
Using File Passwords and Encryption The Read-Only Recommended option places a hurdle in front of a user bent on modifying a document, but only a very small one. To defeat this protection, he or she need only click No at the Open as Read-Only? prompt shown in Figure 14.2. If you are serious about protecting the contents of a document, you need to take the security to a higher level by assigning a password to the document. You can assign passwords to Word documents, Excel workbooks, and PowerPoint presentations. In each case, the program uses the password as a key to encrypt the document contents. The only way to view or modify the document is to supply the password. Here are the steps to follow to assign a password to encrypt a Word document, an Excel workbook, or a PowerPoint presentation: 1. | Select Tools, Options to display the Options dialog box.
| 2. | Display the Security tab.
| 3. | Type a password into one or both of the following text boxes:
Creating Strong Passwords To get the most out of any password-based security, select a strong password, which is one that's meaningful to you (and so easier to remember), but is not easy for someone else to guess (such as your name or your spouse's name). The password should be a minimum of eight characters (longer is better) and should be a mix of letters and numbers. Note, too, that the Office applications differentiate between uppercase and lowercase letters, so remember the capitalization you use. |
Password to OpenThis password is required to view the document (see Figure 14.3). If you don't include the password to modify, the user can edit the document.
Figure 14.3. You see this dialog box when you assign a password to open a document. 
Password to ModifyThis password is required to edit the document's contents. If you don't include the password to open, the user has the option of opening the document as read-only (see Figure 14.4).
Figure 14.4. You see this dialog box when you assign a password to modify a document. 
| 4. | Click OK. The program prompts you to enter the password to open and/or to modify the password. In each case, re-enter the password and click OK.
| 5. | Save the document to put the password into effect.
Don't Forget Your Password If you forget your password, there's no way to retrieve it, and you'll never be able to access your document. As a precaution, you might want to write down your password and store it in a safe place. |
Enhancing Security with Windows Permissions and Encryption If you're running Windows XP Professional and using NTFS as your hard disk file system, you can add another layer of security by applying advanced permissions to the appropriate folders or files. Right-click the folder or file, click Properties, and then display the Security tab. You can also encrypt a folder or file to make it impossible for other people to read the contents. Again, right-click the folder or file, click Properties, and then display the General tab. Click Advanced and then activate the Encrypt Contents to Secure Data check box. |
|
More Options for Protecting Word Documents Applying a password that allows the user to open or modify a Word document is an all-or-nothing strategy. That is, the user can either edit all of the documentthe text and the formattingor none of it. However, there may be scenarios where you want to give someone access to one or the other. For example, you might need someone to modify just the document text, but you want to prevent him or her from messing with the formatting. The next two sections show you how to protect the document formatting and text separately. Locking Document Formatting Like most modern word processors, Word fits into the category of fritterwareprograms with so many formatting bells and whistles that you can end up frittering away hours and hours by tweaking fonts, colors, alignments, and so on. Whether you think of such activity as frittering depends on your point of view, but we all agree that a well-formatted document makes a better impression than a plain or sloppy-looking one. So no matter how much time you've devoted to getting your document just so, the last thing you want is another person running roughshod over your careful look and layout. Fortunately, Word 2003 offers the capability to lock your document's formatting, which prevents others from changing the formatting unless they know the password. Here are the steps to follow: 1. | Display the Protect Document task pane by using either of the following techniques:
Select Tools, Protect Document. Select Tools, Options, select the Security tab, and then click Protect Document.
| 2. | Activate the Limit Formatting to a Selection of Styles check box.
| 3. | Click Settings to display the Formatting Restrictions dialog box, shown in Figure 14.5.
Figure 14.5. Use the Formatting Restrictions dialog box to restrict the formatting another user can apply to a document. 
| 4. | In the Checked Styles Are Currently Allowed list, deactivate the check box beside each style that you want to disallow. Alternatively, use the following buttons to set the check boxes:
- All Click this button to activate all the check boxes and thus enable unauthorized users to apply formatting using only the existing styles; these users can't modify the existing styles or create new styles.
- Recommended Minimum Click this button to activate the check boxes for only those styles that Word determines are necessary for the document.
- None Click this button to deactivate all the check boxes and thus prevent unauthorized users from changing any document formatting.
| 5. | If the user applies an AutoFormat and you want the AutoFormat to apply restricted styles, activate the Allow AutoFormat to Override Formatting Restrictions check box.
| 6. | Click OK.
| 7. | If Word warns you that the document contains disallowed styles, click Yes to remove them or click No to keep them.
| 8. | In the Protect Document task pane, click Yes, Start Enforcing Protection. The Start Enforcing Protection dialog box appears.
| 9. | Type the password twice and then click OK.
|
If you or another authorized user need to change the document formatting, select Tools, Unprotect Document, type the password, and then deactivate the Limit Formatting to a Selection of Styles check box. Preventing Untracked Changes When you share a Word document, it's common to turn on the Track Changes feature so that you can see all the edits made by the other person. Unfortunately, it's easy to turn off Track Changes (either accidentally or on purpose), so you can never be sure whether your document contains any untracked changes.  | For the details on tracking changes in a Word document, see "Tracking Word Document Changes," p. 264 |
If it's important that you track all edits, it's possible to set up Word to prevent untracked changes, and even to enforce this option with a password. Here are the steps to follow: 1. | Display the Protect Document task pane by using either of the following techniques:
Select Tools, Protect Document. Select Tools, Options, select the Security tab, and then click Protect Document.
| 2. | Activate the Allow Only This Type of Editing in the Document check box.
| 3. | In the Editing Restrictions list, select Tracked Changes.
| 4. | Click Yes, Start Enforcing Protection. The Start Enforcing Protection dialog box appears.
| 5. | Type the password twice and then click OK.
|
User-Based Read-Only If you're using Word 2003 in a Windows domain or an Exchange shop, you can set up portions of a document as read-only and you can make exceptions for certain users. In the Protect Document task pane, use the Editing Restrictions list to select No Changes (Read-only). If you want users to edit only a portion of the document, select that portion. In the Exceptions group, click More Users and then type the usernames or email addresses of the users you want to be able to freely edit in the document of the selected portion. |
If you or another authorized user need to freely edit the document text, select Tools, Unprotect Document, type the password, and then deactivate the Allow Only This Type of Editing in the Document check box. More Options for Protecting Excel Workbooks When you've labored long and hard to get your worksheet formulas or formatting just right, the last thing you need is to have a cell or range accidentally deleted or copied over. You can prevent this by using Excel's worksheet protection features, which enable you to prevent changes to anything from a single cell to an entire workbook. Protecting Individual Cells, Objects, and Scenarios Protecting cells, objects, and scenarios in Excel is a two-step process: 1. | Set up the item's protection formatting. You have four options:
Cells, objects, and scenarios can be either locked or unlocked. As soon as protection is turned on (see step 2), a locked item can't be changed, deleted, moved, or copied over. You can protect ranges with a password so that only users who know the password can edit the cells within the range. Cell formulas and scenarios can be either hidden or visible. With protection on, a hidden formula doesn't appear in the formula bar when the cell is selected; a hidden scenario doesn't appear in the Scenario Manager dialog box. Text boxes, macro buttons, and some worksheet dialog box controls also can have locked text, which prevents the text they contain from being altered.
| 2. | Turn on the worksheet protection.
|
These steps are covered in more detail in the following sections. Setting Up Protection Formatting for Cells By default, all worksheet cells are formatted as locked and visible. This means that you have three options when setting up your protection formatting: If you want to protect every cell, leave the formatting as it is and turn on the worksheet protection. If you want certain cells unlocked (for data entry, for example), select the appropriate cells and unlock them before turning on worksheet protection. Similarly, if you want certain cells hidden, select the cells and hide them. If you want only selected cells locked, select all the cells and unlock them. Then select the cells you want protected and lock them. To keep only selected formulas visible, hide every formula and then make the appropriate range visible.
Here are the steps to follow to set up protection formatting for worksheet cells: 1. | Select the cells for which you want to adjust the protection formatting.
| 2. | Select the Format, Cells command, and in the Format Cells dialog box, select the Protection tab.
| 3. | To lock the cells' contents, activate the Locked check box. To unlock cells, deactivate this check box.
| 4. | To hide the cells' formulas, activate the Hidden check box. To make the cells' formulas visible, deactivate the check box.
Hiding Cell Contents Hiding a formula prevents only the formula from being displayed in the formula bar; the results appear inside the cell itself. If you also want to hide the cell's contents, create an empty custom numeric format (;;;), and assign this format to the cell. To create a custom numeric format, select the Number tab, click Custom in the Category list, and then type the format into the Type list. |
| 5. | Click OK.
|
Protecting a Range with a Password If you want to prevent unauthorized users from editing within a range, you can set up that range with a password. After you protect the sheet, only authorized users who know the password can edit the range. Here are the steps to follow: 1. | Select Tools, Protection, Allow Users to Edit Ranges. Excel displays the Allow Users to Edit Ranges dialog box.
| 2. | Click New. Excel displays the New Range dialog box.
| 3. | Type a Title for the range.
| 4. | Use the Refers to Cells range box to select the range you want to protect.
| 5. | Type a password into the Range Password box.
| 6. | Click OK. Excel prompts you to re-enter the password.
| 7. | Type the password and click OK. Excel adds the range to the Allow Users to Edit Ranges dialog box, as shown in Figure 14.6.
Figure 14.6. Use the Allow Users to Edit Ranges dialog box to specify ranges you want to protect with a password. 
| 8. | Repeat steps 27 to protect other ranges.
| 9. | Click OK. (Alternatively, click Protect Sheet to go directly to the sheet protection stage. See "Protecting a Worksheet," later in this chapter.)
|
Setting Up Protection Formatting for Objects Excel locks all worksheet objects by default (and it locks the text in text boxes, macro buttons, and some worksheet dialog box controls). As with cells, you have three options for protecting objects: If you want to protect every object, leave the formatting as it is and turn on the worksheet protection. If you want certain objects unlocked, select the appropriate objects and unlock them before turning on worksheet protection. If you want only selected objects locked, select all the objects and unlock them. Then select the objects you want to protect and lock them.
Selecting All Objects To select all the objects in a sheet, select Edit, Go To, click the Special button in the Go To dialog box, activate the Objects option, and then click OK. |
Follow these steps to set up protection formatting for worksheet objects: 1. | Select the objects for which you want to adjust the protection formatting.
| 2. | Pull down the Format menu and select the command for the selected object or objects (such as Object, Text Box, or Picture), and in the Format Object dialog box, activate the Protection tab.
| 3. | To lock the objects, activate the Locked check box. To unlock them, deactivate this check box.
| 4. | For text boxes or macro buttons, activate the Lock Text check box to protect the text. Deactivate this check box to unlock the text.
| 5. | Click OK.
|
Setting Up Protection Formatting for Scenarios Similar to cells, scenarios are normally locked and visible. You can't work with scenarios in groups, however, so you must set up their protection formatting individually. The following procedure shows you the steps: 1. | Select the Tools, Scenarios command. The Scenario Manager dialog box appears.
| 2. | Select the scenario in the Scenarios list and then click the Edit button. Excel displays the Edit Scenario dialog box.
| 3. | To lock the scenario, activate the Prevent Changes check box. To unlock it, deactivate this check box.
| 4. | To hide the scenario, activate the Hide check box; deactivate it to unhide the scenario.
| 5. | Click OK. Excel displays the Scenario Values dialog box.
| 6. | Enter new values, if necessary, and then click OK.
| 7. | Repeat steps 26 to set the protection formatting for other scenarios.
| 8. | When you're done, click Close to return to the worksheet.
|
Protecting a Worksheet At this point, you've formatted the cells, ranges, objects, or scenarios for protection. To activate the protection, follow these steps: 1. | Select Tools, Protection, Protect Sheet. (If you're in the Allow Users to Edit Ranges dialog box, click Protect Sheet.) Excel displays the Protect Sheet dialog box, shown in Figure 14.7.
Figure 14.7. Use the Protect Sheet dialog box to activate your protection formatting. 
| 2. | For added security, enter a password in the Password to Unprotect Sheet text box. This means that no one can turn off the worksheet's protection without first entering the password.
Protection Without a Password You might wonder why Excel makes the password for unprotecting the sheet optional. That's because the concern here is worksheet integrity: you don't want a user accidentally modifying or deleting formulas or data. When faced with a protected sheet, most users don't automatically look to unprotect it, so protection without a password is almost always a safe option. |
| 3. | Use the check boxes to select the actions unauthorized users are allowed to perform.
| 4. | Click OK.
| 5. | If you entered a password, Excel asks you to confirm it. Re-enter the password and then click OK.
|
To turn off the protection, select the Tools, Protection, Unprotect Sheet command. If you entered a password, Excel displays the Unprotect Sheet dialog box. Type the password into the Password text box and then select OK. Protecting Windows and Workbook Structures You also can protect your windows and workbook structures. When you protect a window, Excel takes the following actions: Hides the window's Maximize and Minimize buttons, Control-menu box, and borders. This means the window can't be moved, sized, or closed. Disables the window menu's New Window, Split, and Freeze Panes commands when the window is active. The Arrange command remains active, but it has no effect on the protected window. The Hide and Unhide commands remain active.
When you protect a workbook's structure, Excel takes the following actions: Disables the Edit menu's Delete Sheet and Move or Copy Sheet commands. Prevents the Insert menu's Worksheet and Chart commands from having any effect on the workbook. Keeps the Scenario Manager from creating a summary report.
Follow these steps to protect windows and workbook structures: 1. | Activate the window or workbook you want to protect.
| 2. | Select the Tools, Protection, Protect Workbook command. Excel displays the Protect Workbook dialog box, shown in Figure 14.8.
Figure 14.8. Use the Protect Workbook dialog box to protect your workbook structure and windows. 
| 3. | Activate the check boxes for the workbook items you want to protect: Structure and/or Windows.
| 4. | Enter a password into the Password text box, if required.
| 5. | Click OK.
| 6. | If you entered a password, Excel asks you to confirm it. Re-enter the password and click OK.
|
Assigning a Password to Your Outlook Personal Folders If your Outlook data file (the one that stores your Personal Folders) resides on a shared network folder, other people can add that file to their own list of Outlook data files. This means they can view your email and other Outlook data as easily as you can. Also, anyone who has physical access to your computer can start Outlook and view your Outlook data. Locking Your Computer If you're concerned that an unauthorized user may sit down at your computer while you're at a meeting or at lunch, you should lock your computer before leaving. In Windows XP, you do this by pressing the Windows Logo+L keys. Alternatively, press Ctrl+Alt+Delete and then click Lock Computer. Note, however, that to truly lock your computer, you must assign a password to your Windows XP user account. This means that another user can't get to Windows unless they enter your password. |
To prevent both scenarios, you should set up your Outlook data file with a password by following these steps: 1. | In Outlook, select Tools, Options to display the Options dialog box.
| 2. | Select the Mail Setup tab.
| 3. | Click Data Files to display the Outlook Data Files dialog box.
| 4. | Select the data file you want to protect and then click Settings.
| 5. | Click Change Password to display the Change Password dialog box.
| 6. | Type your Old Password (this will likely be blank if you haven't done this before), type your New Password and Verify Password, and then click OK.
| 7. | Close the remaining dialog boxes.
|
Protecting Access Data with Passwords and Permissions Access database security usually falls into one or both of the following categories: The database contains sensitive or private data that should be viewed or edited only by authorized users. The database contains production versions of tables, queries, forms, reports, and other objects that should be modified only by authorized users.
To handle both categories, Access offers two types of security: a database password and user-level permissions. The next two sections show you how to implement both types of security. Setting a Database Password If you want to restrict the opening of a database to authorized users only, you need to set up the database with a password. This is useful only for controlling access to sensitive or private data because after authorized users open the database, they're free to modify the data and objects. Following are the steps to set up an Access database (.mdb file) with a password: 1. | Close the database if it's currently open.
| 2. | Select File, Open to display the Open dialog box.
| 3. | Open the folder containing the database and select the database file.
| 4. | Pull down the Open button's list and click Open Exclusive. The database opens with exclusive access.
| 5. | Select Tools, Security, Set Database Password. The Set Database Password dialog box appears.
| 6. | Type the password into the Password and Verify boxes, and then click OK.
| 7. | Close and reopen the database and enter the password when prompted.
|
Removing the Password To remove the password from the database, select Tools, Security, Unset Database Password. Type the Password and click OK. |
Setting User-Level Database Permissions Even Access experts who wouldn't blink an eye when asked, for instance, to replicate a database or program ActiveX Data Objects can get the shakes when asked to implement user-level security for a database. The problem isn't that user-level database security is so hard, it's more that it's notoriously arcane. Matters are made worse by the fact that although Access database permissions bear a distinct resemblance to NTFS file permissions in Windows, the two are not in any way related, and the Access version is just different enough to cause confusion. Normally I'm a big believer in bypassing wizards and getting one's hands dirty with the actual program features that the wizard acts as a front-end for. However, I'm happy to make an exception with Access security because the User-Level Security Wizard is a powerful and easy-to-use alternative to the normal security interface. Here's how the Security Wizard works: 1. | Select Tools, Security, User-Level Security Wizard to open the first Security Wizard dialog box.
| 2. | Activate the Create a New Workgroup Information File option (it may be the only option available to you) and click Next.
| 3. | In the next wizard dialog box, Access generates a unique workgroup ID (WID) and prompts you to enter your name and company name (although these are optional). You also get two choices (click Next when you've made your selection):
- I Want to Make This My Default Workgroup Information File Activate this option to use the new workgroup information file for all your databases.
- I Want to Create a Shortcut to Open My Security-Enhanced Database Activate this option to use the new workgroup information file for the current database only (as well as for other selected files you secure down the road). In this case, the wizard creates a shortcut file to load the database using the /wrkgrp parameter, which specifies your new workgroup information file.
| 4. | The Security Wizard displays the dialog box shown in Figure 14.9 to enable you to specify which database objects you want to secure. Leave the check boxes activated beside each object you want to secure, and then click Next.
Figure 14.9. Activate the check boxes beside the database objects you want to secure. 
| 5. | The Security Wizard displays a list of security group accounts that you can add to your workgroup information file, as shown in Figure 14.10. Each group has a specific set of permissions. (Click a group's name to see a description of the group's permissions.) For example, the Read-Only Users group can view data, but they can't edit data or modify object designs. Activate the check box beside each group you want to include in your workgroup information file, and then click Next.
Figure 14.10. Activate the check boxes beside the security groups you want to include in your workgroup information file. 
| 6. | The wizard asks if you want to assign specific permissions to the Users group (which, by definition, includes all users). The safest way to secure an Access database is to assign permissions to the groups you chose in step 5 and to specific users. Therefore, you should leave the No, the Users Group Should Not Have Any Permissions option activated. Click Next.
| 7. | Use the next Security Wizard to add users to your workgroup information file. For each user, type a User Name and Password and then click Add This User to the List. (If you add a user by mistake, select the user in the list and then click Delete User from the List.) When you're done, click Next.
Add Test Users for Each Group In step 8 the wizard will ask you to assign users to one or more of the groups you chose in step 5. It's a good idea to test the security for each group, and the easiest way to do that is to add dummy users for testing purposes. For example, to test the Full Data Users group, add a user named FullDataUser. For each of these dummy users, assign a common password to make it easier to remember when you're doing the group testing. |
| 8. | The Security Wizard prompts you to assign the users from step 7 to the security groups from step 5. You have two ways to proceed (click Next when you're done):
- Select a User and Assign the User to Groups If you activate this option, use the Group or User Name list to select a user, and then use the check boxes to assign groups to that user, as shown in Figure 14.11.
Figure 14.11. You can assign groups to the selected user (as shown) or users to the selected group. 
- Select a Group and Assign Users to That Group If you activate this option, use the Group or User Name list to select a group, and then use the check boxes to assign users to that group.
| 9. | In the final wizard dialog box, change the location and name of the unsecured backup copy of the database, if desired, and then click Finish. The wizard displays a security report.
| 10. | Close the report window. The Security Wizard asks if you want to create a Snapshot file of the report. (A Snapshot file is viewable with the Access Snapshot Viewer.) Click Yes. Access creates the Snapshot file and displays it in the Snapshot Viewer.
Save Your Snapshot File If you need to re-create your workgroup information file later, you can do so only if you know the exact WID, name, and company name, all of which are included in the Snapshot file. Therefore, be sure to save a copy of the Snapshot file in a secure location. |
| 11. | Select File, Exit to close the Snapshot view. The Security Wizard tells you that your database is now secured.
| 12. | Click OK.
| 13. | Shut down Access.
| 14. | If you chose to create a shortcut to the secured database in step 3, display the Windows desktop and double-click the shortcut file; otherwise, reopen the secured database. The Logon dialog box appears, as shown in Figure 14.12.
Figure 14.12. When you open a secured database, you must log on with a username and password. 
| 15. | Enter the Name and Password of the user and then click OK.
|
To make changes to the user-level security, you have two choices: Select Tools, Security, User-Level Security Wizard to run the wizard again. In the initial dialog box, leave the Modify My Current Workgroup Information File option activated and then follow steps 414. Select Tools, Security. In the submenu that appears, select User and Group Permissions to set specific database object permissions for users or groups. Select User and Group Accounts to add and remove users and groups and change passwords.
|
