FAQ
Q. What is the difference between CDR and traditional antivirus?
Antivirus/Sandboxis the maliciousness of the fileDetectionBy doing so, it only blocks known threats based on signatures or behavior patterns.
Zero-Day AttackIt is vulnerable to unknown threats such as this variant of malware, and continuous signature updates are required.
CDR of SHIELDEX Fileis not a detection methodIdentification, Extraction, Reconstruction MethodIt operates as.
By identifying risk factors regardless of whether they are malicious and extracting only safe content to recombine into a new file, unknown threats can also be blocked in advance.
Q. Is it possible to respond to zero-day attacks?
Yes, it is possible. CDR identifies risk factors without determining the malicious nature of the file and then extracts and reconstructs only safe content, allowing it to preemptively block zero-day attacks or variant malware that do not have signatures.
You can establish a dual defense system by combining the vaccine inspection function.
Preemptively detects malware known as vaccines before neutralization processing and blocks threats not recognized by CDR.
Q. What file formats are supported?
MS Office (Word, Excel, PowerPoint), PDF, Hancom Office, HTML, JSON, images (PNG, JPG, etc.), compressed files (ZIP, TAR, 7Z), and various formats are supported.
Supported extensions and content list areSupported Extensions, Support ContentPlease refer to.
Q. Does it look the same as the original after de-identification?
It depends on the policy settings. The 'Maximum Security' mode identifies risk factors and extracts only safe content to reconstruct it as safely as possible, while the 'Maximum Integrity' mode selects safe content for reconstruction while maintaining the original structure as much as possible.
Core content such as text, images, tables, and layouts is identified and maintained as safe content, ensuring business continuity.
However, since risk factors such as macros, scripts, and hyperlinks are excluded, files that require these functions need to be checked before the sanitization process.
Q. Does it affect system performance?
Since it is processed based on static analysis, the system burden is low. It does not execute files like a sandbox, resulting in lower CPU and memory usage, and system resource usage can be monitored through a real-time dashboard.
If a large file or a compressed file contains multiple files, the processing time may be prolonged, so you can manage system load by setting limits on the number of files and the depth of compression in the policy.
Q. How are password-protected files or encrypted files handled?
Password-protected documents, password-protected compressed files, and files encrypted with DRM are subject to restrictions on decontamination. You can set whether to block them in the policy or to bring them in as they are.
If you do not know the password or encryption key, it is impossible to analyze the internal structure of the file, making it impossible to perform sanitization. Therefore, it is recommended to set up blocking according to security policies.
Q. How are large files or compressed files handled?
Large files can have a size limit set in the policy (recommended: 100MB), and if exceeded, they can be handled by blocking or importing the original.
For compressed files (ZIP, TAR, 7Z), you can set limits on the number of internal files and the depth of nesting to prevent system overload.
Each subfile within the compressed file is individually sanitized, and the results can be checked in detail.
Q. How does the extension forgery check work?
Checks the consistency between the actual format (metadata) of the file and the extension. For example, if the extension appears to be docx but the actual format is exe, it is considered tampering.
It is an important security feature to block malicious files disguised with extensions, and it is recommended to set blocking in the policy.
You can allow exceptions for importing originals for specific extensions if necessary.
Q. What is the relationship between vaccine testing and CDR?
Vaccine testing is performed before decontamination processing to detect known malware in advance. It strengthens security with a dual defense system that combines CDR and vaccines.
Files detected in the antivirus scan can be blocked according to policy, and files that pass the antivirus scan are also blocked against unknown threats through CDR.
Q. Can it be applied to a hybrid environment?
Yes, it is possible. You can integrate through a network linkage solution and REST API, or deploy independently in a network linkage environment.
Hansak, 3Ssoft, HuneSion, and SQubeI have references for integration with existing network linkage solutions, enabling quick implementation.
STN#1, STN#2 redundancy configuration enables stable service provision.
Q. Can policies be set differently for each user?
Yes, it is possible. You can specify and apply different security policies for each user and group.
Policy management can be segmented according to organizational structure such as by department, role, and external collaborators, and it provides policy change history management and restoration features.
You can also apply temporary policies by setting an expiration date in the group policy.
Q. How is the original file stored?
Original file before sanitization and file after sanitization completeAESIt is stored encrypted.
It can be used for cause analysis and reprocessing in the event of a security incident, and can be checked or reprocessed through the backup file download feature.
You can set up a data organization schedule to manage retention periods and operate storage space efficiently.
Q. How is access control managed?
The web console provides IP-based access control (whitelist) so that only registered IPs can access the admin console.
The API is managed by access control based on channel codes and task codes.
You can register access control rules that allow defanging requests by combining channel codes and work codes, and issue API Keys for each permission to enable granular access control.
Q. Is there an audit log and reporting feature?
Yes, it provides. You can view the audit logs for administrator actions (menu access, setting changes, etc.) andCSVYou can export in the format.
It also visualizes and provides file influx patterns, risk distribution, and threat detection status, offering the data necessary for security report writing.
The risk level is classified into 6 stages from 'Safe' to 'Tampering' and visualized, allowing you to check the representative content types and counts for each risk level.
Q. Is it possible to integrate with the existing system?
Yes, it is possible. It provides a standard REST API that can flexibly integrate with various systems such as web gateways, cloud storage, email gateways, and more.
API guide and sample code are provided for quick integration.
It supports asynchronous processing methods, allowing for efficient integration even when handling large files.