When you think of computer security, your thoughts may turn to your network, server, and desktop assets. But how secure are the documents and forms that you use to manage business processes? No matter what industry you're in, a fair number of documents and forms are necessary to run a business.

Both internal and external documents often require signatures. Expense reimbursements need approval; sales and purchasing orders must be routed to several signing authorities; human resources documentation may require multiple signatures; and so on. At many companies, processing documents and forms that require secured signatures, approvals, and routing is often performed via manual, hard-copy practices. This is fine, but the effort needed to manage paper workflow can be a drain on productivity.

Enter a new generation of digital- and electronic-signature software products designed to help you productively and securely manage the processing of documents and forms when signatures, validations, and routing are required. In the past, IT departments were hesitant to embrace digital or electronic-signature solutions and automated-forms workflow for two reasons. First, up until now, many digital and electronic-signature solutions were not mature enough to stand up to the requirements of businesses. Second, there has been a lot of confusion about the digital and electronic signature marketplace. There are hardware-based solutions, services, products that run on server platforms, along with similar desktop-based products. Choosing the best solution for your business can be very tricky.

With regard to maturity, companies that have evaluated secure signature technology and workflow automation in the past will definitely want to revisit the available solutions. As I found during my recent evaluation of two of these products, the technology has improved significantly, and prices have come down to a level that is acceptable for most small and medium-sized businesses.

The only real drawback I found during my recent tests is that many of the solutions in this category are limited to Windows-based technologies. This can complicate things for companies that may be using other computing platforms, such as Linux, Macintosh, or Solaris. To their credit, though, digital- and electronic-signature solution providers are beginning to adopt form standards, such as PDF, HTML, and XML, as well as browser-based access to documents and forms, both of which easily can transcend platforms.

An added note of caution is necessary for any small or medium-sized business that may be considering a move to secure signature technology: When evaluating potential solutions, check implementation requirements very carefully.

I found out during my test drive that many signature solutions support documents and forms formatted in PDF, HTML, and the like. But many also require use of a particular e-mail client, such as Outlook, or a particular Web server, such as Internet Information Server, to implement their solutions. These requirements obviously will render a secure-signature solution useless if your company uses other technology, such as Eudora e-mail clients or the Apache Web server. Shop carefully!

Options

Within the digital- and electronic-signature technology category, there are three distinct product- and service-related segments. Probably the most mature and well-known subdivision is public key infrastructure (PKI) solutions. Products and services in this category enable companies to incorporate public and private key pairs, certificates, and digital signatures into various documents, forms, business applications, and even e-mail.

Beyond PKI solutions, a new breed of products has emerged that can augment a PKI strategy by increasing security. If your business is considering smart cards, fingerprint readers, or retinal scanning solutions, these are considered to be access add-ons that ride over a PKI-based infrastructure.

Most of the recent growth in digital- and electronic-signature solutions comes from a third category of mostly software-based solutions that can work with or without a PKI infrastructure. These solutions are mainly concerned with integrating secured-signature capabilities with key business processes. They usually include repository services, workflow automation, authentication, and the like.

During my test drive, I examined two software-based solutions: Silanis Technologies' ApproveIt and Cardiff Software's LiquidOffice. Both of these products fall into the third category of digital- and electronic-signature solutions, and both are well prepared to integrate with business processes at a reasonable price.

Silanis' ApproveIt

The Silanis ApproveIt solution includes the ApproveIt Desktop and the ApproveIt Collaboration Server. ApproveIt neatly combines digital signatures with electronic-signature capabilities. How are the two different?

A digital signature encrypts a series of numbers that identify the originator of the encryption, the validity of the signature, and whether any changes have been made to the signature. By contrast, an electronic signature adds a visible image of your handwritten signature to the encrypted digital signature. Combining the two technologies gives businesses a very good level of assurance that a document or form signer is the appropriately authorized person.

I had no trouble getting ApproveIt set up on a Windows 2000 platform. The client portion of the solution (Desktop) also can be installed on Windows 95/98 and Windows NT. The ApproveIt Collaboration Server installs on Windows 2000, but requires that you use SQL Server, that form originators use Microsoft Outlook, and that an Internet Information Server is available.

Requirements aside, the ApproveIt solution was marvelously easy to set up and use. The first step was to create an electronic-signature file (called an ePersona file). ApproveIt includes a handy tool that allows you to build an image file of your signature from a variety of sources. I created four signature files: one from a previously scanned signature, another using the mouse, a third from a fax, and a final one directly from a scanner.

Once the signature file is created, the user can select what type of digital signature to combine with the electronic signature image file. ApproveIt supports third-party digital certificates from providers such as Verisign and Entrust. It also lets you generate a self-signed digital certificate.

Combining electronic and digital signatures is handled transparently to the user, and the signature file is password protected. Authorized users do have the ability to modify their signature, if needed. Users also can view their own signature information to verify the validity of their files before signing off on documents.

ApproveIt supports signature capabilities on documents that are formatted using Microsoft Office, PDF forms, and output from Accelio's Capture FormFlow product. This compares with LiquidOffice, which supports PDF and HTML-based forms and document conversion for Microsoft Office and other formats.

I had no trouble inserting multiple signatures in Word documents and PDF forms using ApproveIt. Different users can be granted different rights based on their signing authority. ApproveIt supports five different signature states. These include verify, valid, revalidated, invalid, and unusable.

Document signers will want to verify any previous signatures on a document, and ApproveIt prompts you to do this. You can tell if a signature is valid, has been revalidated, or if it is invalid or unusable based on included icons that ApproveIt displays within documents and forms. ApproveIt can be integrated with Microsoft Office, Adobe Acrobat, and Accelio's FormFlow via menu options that are added to these products during the installation of ApproveIt.

Cardiff's LiquidOffice

As with the Silanis' ApproveIt solution, I had no trouble setting up Cardiff Software's LiquidOffice. The Cardiff solution combines three different tools. The first is the Forms Designer, which I installed on a Windows 2000 platform. This graphical form-building tool also can be installed on Windows 98, ME, NT, or XP. It cannot be installed on non-Windows platforms, such as Mac OS X or Linux. The second part of the LiquidOffice solution--Forms Server--can be installed on Windows 2000, Windows NT, or Solaris 8, and can be used with SQL Server or with Oracle databases. The third piece of the LiquidOffice solution is the Web Desktop, which supplies authenticated access to the Forms Server for form processing and sign-off. The Web Desktop is browser-accessible, and the company officially supports access via Netscape 4.7 or 6.1 as well as Internet Explorer 5.01 and later. However, I also had no trouble accessing the Web Desktop using other browsers such as Opera, Mozilla, and Galeon.

I began my LiquidOffice test drive by creating several forms with the Forms Designer. I found it easy to build forms using the included palette, which offers various form elements.

When adding signature blocks to my forms, I was able to select the attributes that would be in play when the form was accessed and used. For example, I could lock certain form fields until a particular signature was provided. I was also able to define what the signature implied--approval, acknowledgement, or something else.

I had the choice of authenticating the signature with either a LiquidOffice password, click-through on the part of the user, or a certificate. These choices are important because a non-sensitive document, such as a vacation request form, could easily have signatures authenticated via click-through; more sensitive certificates could be used for documents such as loan applications that require greater security.

After creating forms, I configured options to connect to the Forms Server to publish the forms. I specified the Form Server URL and my user login and password. I was then able to connect and publish forms in either PDF or HTML. The publishing process is seamless, and you can complete it relatively quickly. Using a built-in publishing wizard, the user can determine whether the form will be made available to the public or accessible only to a specific group of individuals, such as your sales department.