I have been working in corporate security for more than 20 years, and I have seen too many tragedies in which bosses were kidnapped because of their core drawings, and technical backbones jumped ship with their code, giving away the company's years of hard work overnight. The leakage of confidential drawings is, to put it bluntly, a time bomb for the company. If it is not resolved, it will be difficult to sleep at night. Today I will explain to you 5 local and foreign methods that are really effective in this industry, especially the first one, which is the recognized "housekeeper" after we have deployed it to hundreds of customers.

Five locks on core drawings: 5 hard-core methods for companies to prevent leaks

1. Deploy the Insight Eye MIT system

The longer I work in this business, the more I understand that when it comes to preventing leaks, it is useless to just rely on systems to manage people. You have to rely on technology to lock the data. The Insight Eye MIT system is, to put it bluntly, an "invisible safe" on corporate drawings. It can basically plug the leak holes that are the boss's biggest headache.

1. Documents are transparently encrypted, which does not delay work but leaves the person who stole it stunned. 
   Employees can open and edit drawings internally as usual, but once someone wants to send them out via USB flash drive, email, or WeChat, the drawings instantly become garbled. Last year, at a mechanical design company, a resigned employee copied a complete set of 3D drawings home, only to find that they could not be opened in the new company. The technical director laughed on the spot - this is the hard-core effect of transparent encryption.

2. Outsourcing control, drawings sent to customers can also be set up as a "time bomb"”
   Drawings given to partners used to be sent out and left to chance. Now, for outgoing files generated by the system, you can limit the number of openings, usage time, and even specify that only the other party's machine can read them. A customer sent a mold drawing to a supplier and set a validity period of 3 days. However, if the supplier wanted to postpone production, he had to come back and apply for authorization. The initiative is all in your own hands.

3. Screen watermark + print watermark, so that those who take photos and leak information have no way to hide. 
   Many leaks are caused by employees holding their phones up to the screen to take pictures, or secretly printing them and taking them away. The system can display invisible watermarks of job number and time on the screen, and the source can be traced even if a photo is taken. Last month, a chip design company located an intern based on the job number in the watermark, and took a picture of the core architecture to "show off" to his classmates, handling it clearly.

4. U disks and peripherals are fully controlled, and physical channels are completely blocked. 
   If you can't control the USB port, no matter how good the encryption is, it will be useless. The system can be set to allow only company-certified USB flash drives to be used, and other USB flash drives will be directly disabled when plugged in, eliminating even alarms. A certain software company used to find several cases of private copying of code every month, and the cases were immediately reset after deployment.

5. Full-process audit, you will know who has tampered with your drawings at a glance
   Which department, which computer, which picture was opened at what time, how long the operation was performed, and whether there is any abnormal copying behavior, are all clear in the background. This thing is not to spy on anyone, but if something really happens, you can come up with a chain of evidence within half an hour, which is 10,000 times better than arguing with employees.

2. Physical isolation + intranet access control

Sometimes the dumbest solutions are the most effective. Put the core drawing server on a separate network segment, and create an independent VLAN for the R&D department. Only machines with specific IPs can access the drawings. Coupled with a bastion machine, all operations are recorded. This method is suitable for drawings that are extremely sensitive and should never leave the company in their lifetime. The shortcomings are also obvious. Office efficiency is affected, and remote working is basically impossible. It is suitable for industries with extremely high confidentiality requirements such as military industry and cutting-edge manufacturing.

3. Purchase hardware encryption lock (software dog)

This method is aimed at the design software itself. Equip software such as SolidWorks and AutoCAD with a USB dongle. The dongle must be plugged in when the software is started. The drawing file is bound to the dongle. Without the dongle, it cannot be opened. Some old design institutes still do this, with low cost and quick results. The problem is that there is no way to prevent people from taking photos and screenshots, and there is no way to prevent employees from taking away the entire computer. However, for small and medium-sized manufacturing enterprises, it can be regarded as an immediate and effective means of ensuring the bottom line.

4. Establish a drawing outsourcing approval platform

All drawings to be sent out must go through an online process and be approved by the technical director. The system will automatically add watermarks, limit the validity period, and record the sender and recipient. Don't underestimate this step of the process. Many leaks are actually caused by "posting them casually." Turning outsourcing into a "trouble" can screen out 80% of unconscious leaks. The disadvantage is that it requires people to strictly implement it. If the boss presses you in a hurry, the process will easily become a decoration.

5. Employee behavior monitoring + resignation audit

People are the most unstable factor. Deploy behavior monitoring on employee computers to record all file operations, USB usage, and instant messaging records. Focus on two types of people: one type has a tendency to leave the company recently and frequently accesses the drawing catalog, and the other type has abnormal permissions. Do a detailed audit when resigning, check all outgoing records on the computer, and postpone signatures before completing the formalities. This method, used in conjunction with technical encryption, can nip "insiders" in the bud.

Source of this article: Enterprise Information Security Internal Reference, Manufacturing Data Protection Alliance
Lead writer: Zhou Tiejun
Editor in charge: Zhang Minhua
Last updated: March 25, 2026