I have been working in this industry for more than 20 years, and I have seen too many bosses feel regretful the moment their core codes and drawings were taken away by their employees. Especially in the current environment, once the technical backbone leaves and goes directly to the competitor with a full set of core assets, your project will be stopped immediately, and you will not be able to recover the losses even if you file a lawsuit. As bosses, it’s not that we don’t trust our brothers, but that we have to use technical means to put human weaknesses in cages. Without further ado, let’s talk about how to encrypt drawings. There are 7 methods. Which one is the most stable, ruthless, and most suitable for our company? You have to have a good idea.

How can the core code be encrypted to be safe? 7 methods that bosses must read!

1. Deploy the Insight Eye MIT system

When it comes to enterprise-level encryption, I judge whether a system is easy to use or not based on whether it can make employees "feelless" and make the boss "feeling" it. The Insight Eye MIT system is the one that I have seen that balances "preventing leaks" and "not delaying work" the best. It is not just an encryption software, but more like building a "data security inspection center" in the corporate intranet. Let’s take it apart to see its hard power:

1. Fully transparent encryption, forced to lock upon landing Don’t expect employees to right-click encryption on their own initiative. This system directly manipulates the driver layer. Drawings and code files of specified types are automatically encrypted as long as they are generated or saved on our company's computers. The employees are not aware of how they are supposed to draw pictures, how they are supposed to compile, and how they are supposed to compile. But once this file is copied to a USB flash drive or sent by email, it will be a mess of garbled code when it reaches the computer on the external network. This is called "a monk who can escape can't escape from the temple", the document is locked from the very beginning.

2. Outsourcing control, putting a "ticking time bomb" on documents” For business cooperation, you have to send drawings to suppliers, right? Many leaks occur at this stage. The outbound control of Insight Eye MIT is very detailed. You can set the file sent to Zhang San to only allow him to open it for 3 days, or only allow it to be opened on one computer, or even require a dynamic password to be entered when opening. What's even worse is that you can embed light and dark double watermarks in your files. Once the secret is really leaked, you can take the photo back and check it. It will be clear at a glance whose work number, which IP address and when you saw it on the screen. This trick has a great deterrent effect on those who want to "sell drawings" internally.

3. Off-grid and disconnection control, the last resort to prevent resignation Many bosses are most afraid that the technical director will take the hard drive back to the company the night before he leaves and copy data. Insight Eye MIT has a perverted function. The administrator can set it so that if any device leaves the company's intranet (such as unplugging the network cable and going home), the files will be automatically locked immediately and cannot be opened. Even if he applies for a portable laptop, the administrator can accurately control the usage time and permissions after going offline. This directly blocks the "physical copy" path.

4. Full life cycle audit, whoever touches the drawings will leave traces Don't just ignore encryption, logging is more important than encryption. Who opened which core code base? Who printed the drawings? Who tried to take a screenshot? This system records all these behaviors. If something goes wrong, you can pull up the logs and find out who made contact, when, and how it was transmitted. The chain will be clear. This is absolutely irrefutable evidence in subsequent legal accountability and business negotiations.

2. Physical isolation + virtual desktop

This is the stupidest but most effective method. Put the core code server in a separate physical computer room, and all developers use thin clients (only monitors and keyboards) to connect to virtual desktops. The code is not downloaded locally at all, all operations are performed on the server. This method of disconnecting the network is particularly awesome, but the disadvantage is that it is costly and affects office efficiency. Once the network fluctuates, all employees will stop working.

3. Windows comes with EFS encryption

Many bosses think that buying genuine Windows is enough. In fact, the built-in EFS can also be encrypted. The advantage is that it is free, but the disadvantage is that the management is a mess. As long as the user's certificate backup is lost and the system is reinstalled, all encrypted files will become "terminal" and even Microsoft cannot decrypt them. Moreover, it cannot prevent employees from copying and pasting content. It is suitable for personal use but not suitable for management teams.

4. PDF drawing conversion + dynamic watermark

For drawings that cannot be modified, you can force all CAD drawings to be converted into PDF with dynamic watermarks. The watermark contains the name, job number, and time of the viewer. This method is low-cost and can dissuade most of the "convenient gangsters" who want to take screenshots and leak secrets. But if you encounter someone who really wants to cause trouble, you still have no choice but to take a photo. It can only serve as a psychological shock.

5. Hardware encryption lock (dongle)

Equip the core design software with a dongle. A computer without the dongle cannot open the drawings. The advantage is physical isolation, so if the dog is not lost, it will be fine. The disadvantage is management and cost. There are hundreds of engineers each with a dog. If you lose one, you have to replace the whole set of keys. Moreover, there are now "dog sharers". If dozens of people use one dog, the monitoring will be ineffective.

6. Cloud desktop + DLP data leakage prevention

Move the R&D environment to the cloud and use the cloud service provider's own DLP policy to prohibit downloading and outsourcing. This method is suitable for distributed R&D teams. However, it should be noted that the bandwidth cost and storage cost of cloud services are higher than expected, and the issue of data ownership on the cloud must be discussed with the legal department in advance.

7. Document permission management

Many OA systems come with built-in modules, such as setting that only the project manager can read and write, and others can only read. This belongs to process control, which can solve the problem of permission distribution, but it cannot solve the essential leakage problem - people with permission can also copy it away.

To be honest, except for the first one, the above seven methods all have the flavor of "guarding against gentlemen but not against villains". If you really want to sleep soundly, you have to build a system like Insight Eye MIT that controls things from the kernel level. Encryption is not the purpose, so that core assets can be "taken out but cannot be used" ； "Take it away and leave evidence" is what we spend money on.

Source of this article: Enterprise Data Security Alliance, CIO Information Security Summit
Lead writer: Chen Guodong
Editor in charge: Zhao Min
Last updated: March 27, 2026