Protecting a spreadsheet without using passwords

[nsa]

I have a lot of IP tied up in a spreadsheet that is held on the corporate network. I can password protect it but sometimes I will need to share the spreadsheet with a colleague so I would like another layer of protection so that even if someone gets into the workbook, they will be missing certain keys or information to make it function.

I've had a few ideas but nothing good. Does anyone have experience of this?

[durbster]

It's just not what spreadsheets are designed for so (I'm pretty sure) that's not possible, or practical. It would make more sense to keep a password on the spreadsheet but control access to the folder its inside, if you're using something like Sharepoint. You could have different folders for different access groups.

Having said that, it'd be much easier and you'd be far more secure using a password manager like Dashlane or 1Password. Then you have full control over who can see which passwords. Spreadsheets are easily copied without trace.

[yajeed]

This is probably the textbook Microsoft answer, not that you’ll probably want to use it:

https://docs.microsoft.com/en-us/azure/information...

[peterperkins]

Is the spreadsheet yours or your employers?

Has it been created in their time at their expense?

As part of your job?

[Zetec-S]

Bearing in mind the password protection on excel spreadsheets can be easily cracked with free online software, I'd say relying on it to protect sensitive information is not ideal.

[LordGrover]

Split the data into two linked spreadsheets, separately protected?

[snuffy]

Zetec-S said:

Bearing in mind the password protection on excel spreadsheets can be easily cracked with free online software, I'd say relying on it to protect sensitive information is not ideal.

It's a doodle. I tried following some simple instructions I found and cracked the password in a few minutes on a file I had.

[robbieduncan]

Move all the business logic into a compiled add-in for Excel?

[hondafanatic]

robbieduncan said:

Move all the business logic into a compiled add-in for Excel?

What do you mean by this? Many thanks...

[Harpoon]

snuffy said:

It's a doodle. I tried following some simple instructions I found and cracked the password in a few minutes on a file I had.

It was easy on old versions of Excel (.xls) but when MS started using AES128 and then AES256 (Excel 2007 and 2016 IIRC?) to encrypt things, I was under the impression the only attack method is brute force / dictionary.

[selym]

durbster said:

It's just not what spreadsheets are designed for so (I'm pretty sure) that's not possible, or practical. It would make more sense to keep a password on the spreadsheet but control access to the folder its inside, if you're using something like Sharepoint. You could have different folders for different access groups.

Having said that, it'd be much easier and you'd be far more secure using a password manager like Dashlane or 1Password. Then you have full control over who can see which passwords. Spreadsheets are easily copied without trace.

It definitely is possible - I worked with a guy who devised a spreadsheet for completion by say 10 different agencies. The issue was they weren't allowed to see or edit anything but their column. My oppo designed a spreadsheet that allowed admin access to all of it, and each user could only access their own 'bit'. Just a bit of code which protected the spreadsheet.

Being an IT biff, I couldn't begin to tell you how he did it.

[Baldchap]

If it's on your corporate network get your sysadmin to lock down the file/folder permissions to whoever should have access.

Job jobbed.

[Zetec-S]

Harpoon said:

It was easy on old versions of Excel (.xls) but when MS started using AES128 and then AES256 (Excel 2007 and 2016 IIRC?) to encrypt things, I was under the impression the only attack method is brute force / dictionary.

Definitely used one on 2007, and almost certainly on 2010 as well. Not sure about later versions...

[NickCQ]

LordGrover said:

Split the data into two linked spreadsheets, separately protected?

Or add input / output dashboards on new worksheets and hide all other tabs that contain ‘proprietary’ calculations? Then lock the workbook, which IIRC prevents access to hidden sheets (until the password gets cracked).

[Australiam]

I am slightly unclear whether you want to protect the IP from the person you have authorised to look at the spreadsheet, or other 3rd parties?

If the person you have authorised - I suggest you re-think. As far as I am aware, if you give them access to the spreadsheet, the native controls within Excel are limited (though I will watch this thread to see if others disagree).

If it is protection against access by other 3rd parties (assuming any IT team is happy for you to solve this on your own) if you are not happy using Excel's own encryption, consider using a 3rd party file encryption tool. Take a look at AxCrypt as one example.

However - I know I am stating the obvious, but if you encrypt files, make sure you fully understand the decryption process, any native key recovery process and have some form of key management process to ensure you can always access your own data.




EDIT: Sorry - I just re-read that you do not want to use passwords. I'll leave my post in case it generates conversation, but appreciate that this does not solve your problem. I am not aware of how you will achieve this without passwords... so will watch the thread in anticipation!

Edited by Australiam on Tuesday 22 October 10:41

[sparkypups]

Best way I use is to;

Put sensitive data on separate tab
Mark tab as xkveryhidden
Add password to vba if necessary

The vast majority of people look for hidden tabs, and dont look at the code for very hidden tabs

[snuffy]

Harpoon said:

It was easy on old versions of Excel (.xls) but when MS started using AES128 and then AES256 (Excel 2007 and 2016 IIRC?) to encrypt things, I was under the impression the only attack method is brute force / dictionary.

Ah, I was thinking of the VBA project password, which is not the same thing of course.

Anyway, if you have password protected your VBA code the even in version 2016 you can recover it.

[768]

nsa said:

I have a lot of IP tied up in a spreadsheet that is held on the corporate network.

nsa said:

I can password protect it but sometimes I will need to share the spreadsheet with a colleague so I would like another layer of protection so that even if someone gets into the workbook, they will be missing certain keys or information to make it function.

Not sure I follow, but perhaps send them an export of just the information they need rather than the whole spreadsheet then?

Failing that, I'm sure it's possible to hook Excel up to a database and an identity provider, but at that point perhaps it's time to move on from Excel.

[768]

Australiam said:

EDIT: Sorry - I just re-read that you do not want to use passwords. I'll leave my post in case it generates conversation, but appreciate that this does not solve your problem. I am not aware of how you will achieve this without passwords... so will watch the thread in anticipation!

Keys which don't derive from passwords. But I doubt he'd be after those either.

[Mr Pointy]

nsa said:

I have a lot of IP tied up in a spreadsheet that is held on the corporate network. I can password protect it but sometimes I will need to share the spreadsheet with a colleague so I would like another layer of protection so that even if someone gets into the workbook, they will be missing certain keys or information to make it function.

I've had a few ideas but nothing good. Does anyone have experience of this?

Well unless you own the company it's likely the company has a lot of IP tied up in the spreadsheet, not you.

If it's vital to the company operations the first thing would be to make sure someone in authority has all of your passwords so they can continue operating in the event you fall under a bus.