Brothers, today we will not deal with those vain people. I know you bosses can't sleep at night, thinking about one thing over and over: Will those millions of lines of core code in the code base appear on your competitor's server when you open your eyes tomorrow?

Don't deny it. The core assets of a team that has been raised through hard work are just taken away by employees with a Ctrl+C, or by sending a package and email. Isn't this kind of thing rare in the industry? Today, I am not going to talk about ideals with you, but I will talk about something practical - how to lock this thing so that people who shouldn't touch it can't touch it, and things that shouldn't be taken away can't be taken away.

To prevent core code leakage, an inventory of 6 file encryption methods that bosses must read

1. Deploy the Insight Eye MIT system

This thing is recognized by our group of old guys who have been working in security for decades as the most worry-free and least afraid of moles. Don't listen to the bells and whistles out there. Real enterprise-level encryption must be so subtle and silent that those who do damage must have no temper at all. The Insight Eye MIT system does not rely on scaring people, but on real hard work.

1. Fully transparent encryption, forced to lock upon landing Don’t expect employees to be self-aware. This system works directly on the bottom layer of the operating system. As long as the codes and documents generated and saved on our company's internal computers are encrypted as soon as they are implemented. The employees themselves can open and edit it, but if they dare to copy it to a USB flash drive or send it to their personal WeChat, it will come out as a bunch of garbled code. Boss, isn’t the effect you want to be “visible but not taken away”? This is called the landing effect.

2. Outgoing files are protected against secondary proliferation, and permissions are accurate to seconds.  Sometimes I have to send the code to outsourcing and show it to customers. The moment you send it out, you have to be prepared that it could be forwarded to anyone. The Insight MIT system can set "curses" on outgoing files - opening passwords, limiting the number of accesses, or even restricting them to only being opened on a certain machine. After the set time is exceeded, the file is automatically destroyed. Don't worry about what he has in his hand. Without our authorization, he can't even take a look at it.

3. Leak tracking and auditing, it’s clear who has touched what Don't wait until the code has been posted online before pursuing accountability. It's too late. This system can clearly see the behavior of everyone in your team: Who opened which core file today? Who tried to print to the printer? Who tried to take a screenshot? It's all recorded in the background. The purpose is not to spy on anyone, but to make it clear to those who want to take action that if he dares to reach out, he will leave irrefutable evidence. This is called deterrence beforehand and retrospection afterwards, blocking both ends.

4. Anti-screenshot, anti-recording, anti-virtual machine Some smart people think that if the files cannot be copied, then I can just use my mobile phone to take pictures, right? This system comes with an "anti-human" design. After turning on the anti-screen capture mode, let alone the screen capture software failure, even the screen recording tool cannot capture the content in certain circumstances. Want to use a virtual machine to bypass encryption? There is no door. The system directly prohibits the running of sensitive files in unauthorized virtual environments. Block all the crooked ways you can think of.

2. Hardware encryption USB disk/encryption lock

This method is relatively old-school, but it works in certain scenarios. Buy a USB flash drive with a hardware encryption chip, or a dongle encryption lock. Plug it in when you use it, and the code can be decrypted and used. ； Unplug it and the data will be automatically locked. The disadvantages are also obvious. First, the cost is high. Each person has one lock. When the team is big, it becomes crazy to manage. ； Second, if the lock is lost, the data will also be "lost". It is suitable for small teams to protect a single core asset. If a large team uses this, it will only bring trouble to themselves.

3. Add a password to the compressed package

The most rustic, but the most common method. Pack the code into a package, set a password, and send it to the other party. In the eyes of our industry, this approach is equivalent to being undefended. First, how do I give the password? Send via WeChat? Send text message? Once it's leaked, it's all in vain. Secondly, there are many tools available online to crack compressed package passwords. For "careful people" with a little patience, this shell is no different from paper. Just to guard against sending emails by mistake. If you really want to guard against professional insiders, this trick won’t even reach the passing mark.

4. Privately deployed code warehouse (Git/SVN) with permission control

A boss with a technical background will do this. Build your own Git server and assign branch permissions to R&D. Only a few people can access the core branches. This is indeed one of the right ways, but the problem is that it can control online but not local. After an employee pulls the code to the local development environment, what should he do with the "clear text" on his local computer? No matter how strict the warehouse permissions are, they will be copied directly from the local hard disk, and the permissions on your server will become a decoration. Therefore, this trick must be used in conjunction with the first trick (transparent encryption of documents), otherwise you will close the door and forget to close the window.

5. Network isolation + cloud desktop development

Be completely ruthless and prevent all developers from leaving code locally. Each person has a thin client, connected to the company's internal cloud desktop or virtual desktop, and all development and compilation are completed on the server side. The terminal cannot get any actual data. This method has a very high security level, but the cost is also very high. Server computing power, network bandwidth, and operation and maintenance complexity are all money. Moreover, the user experience will be affected. If it gets stuck or disconnected, the programmer can destroy your office. It is not an absolutely core military-level project, and most bosses are reluctant to bother with it.

6. DLP data leakage prevention system

It is similar to the Insight Eye MIT system, but it is a broader protection. It monitors all data exports through policy control, such as emails, web pages, IM software, printing, Bluetooth, etc. Once it is detected that sensitive content is being sent out, it will be intercepted and alerted immediately. However, many DLP systems on the market are too "stupid", with high false alarm rates and pop-up windows every three days, seriously affecting business. A truly useful DLP must be like the insightful MIT, which can not only stop, but also intelligently identify what is normal business and what is malicious behavior. Light will block it, it's a firewall ； Only those who can judge are called systems.

Source of this article: Enterprise Data Security Defense Laboratory, CIO Security Alliance
Lead writer: Chen Guodong
Editor in charge: Li Wanting
Last updated: March 27, 2026