Security on very hidden sheets

[mnby9brj]

I hope someone can help.

I have got two sheets, one with a reasonably large table of data of information held about individuals and a second sheet which is to be used by the end user. The end user will enter their name, date of birth and their unique reference number and based on the information entered, the end user sheet will look at the table of data and feed back the single line of information held about the individual.

I have made the data table sheet "very hidden" using VBA and have password protected the VBA code. I have also locked all the cells on the end user sheet other than the cells where they enter their name, DoB and unique reference number.

The problem I have got is that although "very hidden", the end user could still retreive all of the data within the table (by saving the file, opening up the visual basic editor and making a note of the hidden sheet name and then after opening up a second instance of excel they could type " ='[End user spreadsheet.xlsm]hidden sheet'!A1 " then copy the formula down and across to reconstruct the hidden table).

I am looking to send this spreadsheet to a group of teenagers and the risk is that they are savvy enough to retreive the data.

Is there any way that I can prevent the opening of the Visual Basic Editor or hide the name of the sheet from the list of worksheets in the Visual Basic Editor? Or is there another solution I have not thought of?

I would consider the data table to be mildly sensitive so depending on security levels that can be acheived through Excel, it may be decided that Excel is not the best solution.

Many thanks in advance.

Brian

 

[jbeaucaire]

If you have password protected the VBAProject and set the "locked for viewing" flag, then the user cannot see the sheet names.

 

[GTO]

...I am looking to send this spreadsheet to a group of teenagers and the risk is that they are savvy enough to retreive the data.

Is there any way that I can prevent the opening of the Visual Basic Editor or hide the name of the sheet from the list of worksheets in the Visual Basic Editor? Or is there another solution I have not thought of?...

Not to disagree with jbeaucaire at all, but just to add, if the info is sensitive enough and/or your sense is that the user's would make any serious attempt at hacking the info, well... There is freeware and/or cheap software that will remove the project's protection outright.

While any protection can only really be thought of in terms of, "to what ends would the user likely go to to hack this" vs. the level of protection, Excel cannot really be thought of as a secure environment at all.

 

[AhoyNC]

I would agree with GTO. There is software that will remove or change the passwords.
In Bill Jelen's (MR Excel) book on VBA he warns that the security is not all that hard to hack.

 

[mnby9brj]

Thank you for your comments - much appreciated. Maybe excel is not the answer. Hmmm, back to the drawing board.

Brian.

 

[jbeaucaire]

My apologies for a less than complete answer, earlier. I was just responding to the assertion that sheetnames were visible in a password-protected-VBAProject. They should not be if the "lock for viewing" option is selected.

But in line with what the others have noted above, let me quote a doc I wrote for a client last year:

"As for Excel and 'security' in general, I have to admit that regardless of how much security you attempt to build into an Excel workbook, it's surmountable. In my opinion the only "secure" spreadsheet is a PDF."

...To which my client asked, "And how do we control who sees the PDFs?".

We laughed for a week. Onward...

 

[Sal Paradise]

One option would be to use encoding of some sort on your data. While teenagers may be smart enough to get a tool to unlock the data, if the data is encoded with complex math, there is a far smaller chance that they will go through the math to figure out how to de-encode the data.

Take a look at this post:
http://www.mrexcel.com/forum/showpost.php?p=269735&postcount=17

It won't totally stop them, but it will turn the data into gibberish unless they understand xor decryption.