Article opening paragraph

At three o'clock in the morning, the R&D director pulls you out of bed with a phone call: "Boss, our set of algorithm source code that was kept at the bottom of the box seems to have been taken away by Mr. Wang who resigned! ”Experiencing this kind of scenario once will give you PTSD from the words "core code leakage". Don’t rely on employees’ self-awareness or the few locks in the office. After working in the data security industry for more than 20 years, I have seen too many bosses give away years of hard work because documents were not encrypted. Today, let’s not dwell on it, let’s go straight to the practical stuff and talk about how to lock the “lifeblood” documents into a safe.

Is the core code copy-proof? These 10 document encryption methods must be monitored personally by the boss!

1. Deploy the Insight Eye MIT system

Don't look for those free gadgets right away, that's just playing house. If you really want to protect the R&D team with dozens or hundreds of people, you have to rely on an enterprise-level "watchdog"”—— Insight Eye MIT System . This thing is not simply to add a password to the file, but to install a "eye in the sky" for the entire data flow process.

1. Kernel-level transparent encryption, no sense is the highest state Employees can open and edit code and documents normally without feeling any lag. Once the file is copied, pasted to a USB flash drive, sent to WeChat, or even just taken as a screenshot, what is saved will be garbled. Last year, there was a company engaged in self-driving. The insider wanted to take a picture of the screen with his mobile phone. As a result, the code lines in the photo were directly covered with watermarks, and even OCR could not recognize them, and he was exposed on the spot.

2. Enforced sandbox protection for source code In the R&D environment, development tools such as Visual Studio and IDEA are classified into the "security sandbox". Code can only flow inside the box, want to pull it out? There are no doors. If employees want to debug a program, they have to go through the approval process, which blocks the outbound route. This is like welding the door of the vault shut, and the key is only in your own hands.

3. Accurate outsourcing and decryption approval Does the business need to send code to customers or third parties? The system supports dynamically generating decryption policies based on recipients, file confidentiality levels, and validity periods. After the file is sent out, the other party can only read it but cannot modify it. It will be automatically destroyed when it expires to prevent secondary diffusion. I have seen too many codes obtained by partners, which instantly become the "starting line" for competing products.

4. Full life cycle audit and traceability Who opened which file at what time, how long the operation lasted, whether it was copied or deleted, write down everything in detail. Once abnormal operations are discovered, the system automatically blocks and alerts. In a financial technology project last month, the system detected that someone was accessing the core algorithm library in batches at three in the morning. The suspicious account was forced offline before the administrator arrived at the company.

5. Offline and mobile management and control When employees are on business trips or working from home, their laptops are still under control even if they are disconnected from the intranet. The system can set offline policies, such as viewing only, prohibiting printing, and automatically locking after timeout. Even if the notebook is lost, the data cannot be taken away.

2. EFS encryption that comes with Windows

Features that come with Microsoft systems, no extra money required. Right-click the file properties and check "Encrypt content to protect data". Easy to operate, suitable for storing scattered files on personal computers. But the problem is also big. Once you reinstall the system without backing up the encryption certificate, those files will become completely useless, and even gods can't save them. In an enterprise environment, where dozens of employees are doing their own things, key management is a disaster and is not recommended as the main method.

3. Compressed package encryption (WinRAR/7-Zip)

The most primitive but most commonly used method. Package the file, set a complex password, and send it to the other party. The effectiveness of the implementation depends entirely on the password strength. If you use "123456" or the employee's birthday, it means it is not locked. What's even more troublesome is that you can't control the secondary propagation of the compressed package after it reaches the other party. If they change hands and send it to the next party, once you lose the password, you have no clue.

4. Office documents with built-in passwords

You can set "open password" and "editing restrictions" in Word and Excel. It is also useful for temporarily uploading financial forms and marketing plans. But there are a lot of cracking tools on the market, and someone with a little bit of care can crack the password in ten minutes. For high-value assets such as source code, this protection strength is approximately zero.

5. Hardware encryption lock (U-shield type)

Insert a USB shield to open encrypted files. It sounds hard-core, but in actual management it is full of pitfalls. The company sends out hundreds of U-Shields, but if employees lose or forget to bring them, their work is paralyzed. What’s even more frightening is that some technical geeks will use tools to simulate U-shield signals and “cheat” the encryption lock into it, and the code will still be copied away.

6. PDF document digital signature and rights management

Convert code or documents to PDF, then set digital signatures, prohibit printing, and prohibit copying. The final version of the document is suitable for external distribution and can prevent casual dissemination by non-technical personnel. But in the face of knowledgeable programmers, they will directly decompile the PDF or take screenshots, and the protection effect is quite limited.

7. Build privatized Git+ permission control

The most common code hosting method used by technical teams. Build GitLab and Gitea on the server, and set strict read and write permissions for each project and each branch. The implementation effect is good and it can standardize the code flow. But the shortcoming is that it only cares about the code in the warehouse. Once it is cloned locally, it becomes a wild horse and cannot control the developer's local copy and secondary outsourcing.

8. Enterprise network disk (privatized deployment) permission control

Many companies now use private network disks to replace traditional file servers. The advantage is that permission management is detailed and can be accurate to read-only/download/share of folders and files. But like Git, once the file is downloaded to the terminal device, the permissions become invalid, and the system cannot prevent the user from copying the file or uploading it to a personal network disk.

9. Screen watermark and print watermark

Add an explicit "Company Confidential" watermark or an implicit dot matrix watermark to the important document display area or printed paper. This is a deterrent to keep employees from taking photos or making copies. However, it cannot fundamentally prevent leaks and is a "patch" for post-event accountability.

10. Physical isolation and dual network machines

The most extreme approach. The development environment is completely physically disconnected from the Internet, and all data is copied to CDs or special media and strictly registered. Commonly used in military industry and secret-related units. But the price is that almost all work efficiency is sacrificed. Communication relies on shouting, and collaboration relies on running. Most commercial companies simply cannot withstand this kind of internal friction.

Source of this article: Enterprise Data Security Governance Alliance, CSO Information Security Internal Reference
Lead writer: Chen Guodong
Editor in charge: Zhao Yifan
Last updated: March 27, 2026