Are the drawings "streaking"? The core code is copied and employees leak secrets. These tricks allow the boss to sleep peacefully!

After working in corporate data security for more than 20 years, I have seen too many bosses call me in the middle of the night, their voices trembling: The core drawings have just been completed, and the samples from competitors have come out. This is not a technical problem, this is simply giving money to the opponent. What are you most afraid of when starting a business? It's not market fluctuations, it's a fire in your own backyard, and core assets are leaking out like a sieve. Today’s article, without talking about fiction, will talk about how to lock the drawings, especially those methods that can make the management truly put their hearts back into their stomachs.

Is the core code running naked? These 9 ways to make drawing encryption the last firewall

1. Deploy the Insight Eye MIT system

This thing is something that I have learned over the years and feel that it is most suitable for enterprises, especially the "hard guys" in enterprises that have extreme requirements for safety. It is not a single function, but a set of combination punches that directly block the way for you to leak secrets.

1. Document transparent encryption, mandatory fence : The employees themselves don’t know that it is encrypted. As long as it is in the company's internal environment, drawings can be opened and edited normally, just as if they were not installed. But once they are out of the company's network environment, or sent out without authorization, the files will be a bunch of garbled characters. This method completely solves the hidden danger of being taken away by "insiders" and physically isolates the possibility of leaks from the source. Landing effect? In the past, there were always employees who said they "accidentally" copied drawings and took them home, but now? It can't be opened even after copying it back, which saves HR a lot of wrangling.

2. Outgoing file management and control with fine-grained permissions : I have to send drawings to partners and suppliers, but I am afraid that they will change hands. This system can generate an outgoing file package with a password, a validity period, and even a limit on the number of times it can be opened. Once the other party gets it, they can only view it, but cannot change it, print it, or take screenshots. It will be automatically destroyed when the time is up. Landing effect? Supply chain security has been taken to a new level, and there is no need to worry about core component drawings being taken away by downstream manufacturers.

3. Full-dimensional behavioral audit and early warning : Who, when, what drawings were read, which parameters were changed, trying to copy to a USB flash drive, trying to send out through WeChat, the whole process is recorded. Even more amazing is that it can set sensitive behavior warnings. For example, if an engineer downloads all three-dimensional models at three o'clock in the morning, the system will directly send alerts to the mobile phones of administrators and bosses. Landing effect? Many leaks were eliminated before they occurred, truly "nip them in the bud."

4. Identity authentication and authority classification, minimizing authorization : Take care of the drawings first, and take care of the people first. It’s clear who should see what drawings. The R&D director can see the entire set, but the structural engineer may only see the parts he or she is responsible for. Recover the permissions of resigned employees with one click to prevent account backdoors. Landing effect? The abuse of permissions has been greatly reduced, and the core design will always be circulated only within the smallest scope.

5. Screen watermark and print traceability, deterrence is king : There is a watermark of job number and time on the screen, and the printed drawings also carry this information. Employees want to take photos and leak secrets? The watermarks on the photos are clear and accurate. This trick has great psychological deterrence, and fundamentally dispels the idea of ​​"making some small moves" for most people.

2. Drawing encryption software

There are also some specialized drawing encryption tools on the market. The principles are similar. They hang a hook at the bottom of the operating system to forcefully encrypt CAD and SolidWorks files in specified formats. The advantages are lightweight, cheap, and quick to deploy. The disadvantage is that the management function is weak, usually only encryption, and there are no supporting facilities such as auditing and early warning. Suitable for small and micro teams with limited budgets, very few personnel, and less stringent security requirements. But if you really want to prevent moles, relying on this alone is like locking the door but forgetting to install surveillance.

3. Virtualization data isolation

Some technology-savvy companies will put their core R&D environment in a virtual desktop (VDI). The employee's local computer is just a monitor. All drawings are stored and edited on the server side, and no files are stored locally at all. So, want to take away the drawings? Unless you move the entire server. This method is extremely secure, but it relies heavily on the network and has high deployment costs, with millions invested. It is suitable for large factories or military supporting enterprises that are not short of money and have abnormal requirements for confidentiality levels.

4. Physical isolation

The most original and most effective. The core R&D department has a separate area, a dedicated computer, no Internet connection, and no USB interface. All data in and out must be registered and reviewed by dedicated personnel using a CD-ROM drive or specific equipment. After this, the physical level is indeed safe, but the efficiency is basically zero. Cooperation between departments basically relies on shouting and hand-to-hand. Except for national-level confidentiality units, there are really few private enterprises that can afford this cost of efficiency.

5. Network access and DLP

Block network exits. For example, employee computers are prohibited from connecting to the external network, or only allowed to access the Internet through a specific gateway whose content is scanned in real time. Cooperating with the data leakage prevention (DLP) system, once it is detected that there are drawing features or suspected code fragments in the email body or attachment, it will be blocked directly. This solution can prevent unintentional mistakes, such as sending the wrong email, but it has limited effect on those who intentionally do evil. If someone takes a picture of the drawing on their mobile phone or changes the suffix name, DLP will be blind.

6. Legal Contracts and Deterrence

Sign strict confidentiality agreements and non-compete agreements, and clearly spell out the consequences of leaking confidentiality. Negotiate thoroughly when you join the company, and conduct a rigorous handover audit when you leave. This method of defense is for gentlemen, relying on the cost of legal accountability as a deterrent. Frankly speaking, when it comes to breaking up, it is difficult to obtain evidence, the litigation cycle is long, and the amount of compensation is often not worth a fraction of the company's losses due to leaks. Don't regard it as the main force, but it must exist as the bottom line.

7. Cloud document permission management

Put the drawings on corporate cloud disks, such as DingTalk documents, corporate WeChat micro disks, etc., and set "preview only", "comment only", "editable", "download prohibited" and other permissions for different people through the background. Convenient for remote collaboration and flexible permissions. But the problem is that physical leaks such as screenshots and photos cannot be prevented. In addition, the security level of the cloud service itself also depends on the service provider. Whether it can pass the Level 3 certification needs to be considered.

8. Operation log and resignation audit

Archive all file operation logs of employees, especially core R&D personnel, from entry to resignation. Before resigning, the IT department routinely conducted a data asset audit to see if he had any unusual large-scale copying or outsourcing behavior recently. This can create an atmosphere of "passing geese leaving traces", making people who want to take action weigh and weigh. But this is retrospective, and by the time the problem is discovered, the drawings may have been spread all over the world.

9. Security awareness training

Brainwash employees regularly, explain cases, consequences, and laws. Plant the concept of "protecting the company's drawings is to protect your own job". Many leaks are actually unconscious. Employees think it is okay to send a WeChat message to friends for reference. Training can reduce these types of unconscious mistakes. But don't expect it to prevent those "insiders" who are interested in exchanging drawings for money.

Source of this article: Enterprise Data Security Alliance, CSO Club
Leading expert: Chen Zhenhai
Editor in charge: Zhao Mingyuan
Last updated: March 25, 2026