FAQ
Q. What is the difference between CDR and traditional antivirus?
Antivirus/Sandboxis the maliciousness of the fileDetectionBy blocking only known threats based on signatures or behavior patterns.
Zero-Day AttackIt is vulnerable to unknown threats such as ransomware variants and requires continuous signature updates.
CDR of SHIELDEX Fileis not a detection methodIdentification, Extraction, Reconstruction MethodIt operates as.
By identifying risk factors regardless of whether they are malicious and extracting only safe content to recombine into a new file, unknown threats can also be blocked in advance.
Q. Is it possible to respond to zero-day attacks?
Yes, it is possible. CDR identifies risk factors without determining the malicious nature of the file and then extracts and reconstructs only safe content, allowing it to preemptively block zero-day attacks or variant malware that do not have signatures.
You can establish a dual defense system by combining it with the vaccine inspection function.
Preemptively detect malware known as vaccines before decontamination processing, and block threats not recognized by CDR.
Q. What file formats are supported?
Supports various formats such as MS Office (Word, Excel, PowerPoint), PDF, Hancom Office, HTML, JSON, text, images (PNG, JPG, etc.), and compressed files (ZIP, TAR, 7Z).
Supported extensions and content list areSupported extensions, Support ContentPlease refer to it.
Q. Does it look the same as the original after de-identification processing?
It depends on the policy settings. The 'Maximum Security' mode identifies risk factors and extracts only safe content to reconstruct it as safely as possible, while the 'Maximum Integrity' mode selects safe content for reconstruction while maintaining the original structure as much as possible.
Core content such as text, images, tables, and layouts is identified and maintained as safe content, ensuring business continuity.
However, since risk factors such as macros, scripts, and hyperlinks are excluded, files that require these functions need to be checked before being sanitized.
Q. In what cases is the 'record mode' of the file import method used?
'Record mode' is an operational mode that processes and records results according to policy, while importing is done with the original file.
You can select it in the 'File Import Method' under [Policy] > [Basic Decontamination Policy] > [Common] tab along with 'Decontamination Processing' and 'Original Import'.
It is useful to record and analyze actual processing results before fully implementing the new policy to perform policy validation.
Q. Does it affect system performance?
Since it is processed based on static analysis, the system burden is low. It does not execute files like a sandbox, resulting in lower CPU and memory usage, and system resource usage can be monitored through a real-time dashboard.
If a large file or a compressed file contains multiple files, the processing time may be prolonged. Therefore, you can manage system load by setting limits on the number of files and the depth of compression in the policy.
Q. How are password-protected files or encrypted files handled?
Password-protected documents, password-protected compressed files, files encrypted with DRM, and files with unidentifiable formats are handled as separate policy items. Each policy can be configured to either block or allow the original to be imported as is.
If you do not know the password or encryption key, it is impossible to analyze the internal structure of the file, making it impossible to perform sanitization. Therefore, it is recommended to set up blocking according to security policies.
Q. How are large files or compressed files handled?
Large files can have a size limit set in the policy (recommended: 100MB), and if exceeded, they can be handled by blocking or importing the original.
For compressed files (ZIP, TAR, 7Z), you can set limits on the number of internal files and the depth of nesting to prevent system overload.
Each sub-file within the compressed file is individually sanitized, and the results can be checked in detail.
Q. How is the EML (email) file sanitized?
EML files process each attached file contained within them individually for sanitization.
Attachments blocked by policy will be replaced with files in the form of 'originalfilename.txt'.
Once the neutralization process is complete, the processed attachment is recombined into an EML file and returned, allowing you to receive the result in the same EML format as submitted upon request.
Q. How does the extension forgery check work?
Checks the consistency between the actual format (metadata) of the file and the extension. For example, if the extension appears to be docx but the actual format is exe, it is considered tampering.
It is an important security feature to block malicious files disguised with extensions, and it is recommended to set blocking in the policy.
Exceptions for allowing the import of original files for specific extensions can be made if necessary. Exceptions can be set in the [Exceptions] tab > 'Extension Tampering Block Exception Settings'file extensionRegister as an input method.
Q. What is the relationship between vaccine testing and CDR?
The vaccine check is performed before the neutralization process to detect known malware in advance. It enhances security with a dual defense system that combines CDR and the vaccine.
Files detected in the antivirus scan can be blocked according to policy, and files that pass the antivirus scan are also blocked against unknown threats through CDR.
Q. What can be configured in the vaccine management menu?
In the [Settings] > [Vaccine Management] menu, you can manage whether to use vaccine scanning (ON/OFF), information about the applied vaccine engine (engine version, license expiration date, remaining days), and the timing of license expiration notifications.
If the license is about to expire or has expired, a banner notification will be displayed at the top of the admin console, and the start time for the notification can be set to N days before the expiration date (default 30 days).
Q. Can it be applied to a hybrid environment?
Yes, it is possible. You can integrate through a network separation solution and REST API, or deploy independently in a network separation environment.
Hansak, 3Ssoft, HuneSion, and SQubeI have references for integration with existing network linkage solutions, allowing for quick implementation.
STN#1, STN#2 redundancy configuration enables stable service provision.
Q. Can policies be set differently for each user?
Yes, it is possible. You can specify and apply different security policies in the [Policy] > [Individual Policy] menu for each user and group.
Policy management can be segmented according to organizational structure such as by department, role, or external collaborators, and it provides policy change history management and restoration features.
You can set expiration dates for each item in the integration system policy and individual policies, allowing for the application of temporary policies.
Q. When there are multiple policies, which policy is applied first?
When multiple policies are applied simultaneously, they are processed according to the following priority.
- Individual Policies > User Policies
- Individual Policy > Group Policy
- Integration System Policy
- Basic Demilitarization Policy
The items set in the upper policy take precedence, and the unset items follow the values of the next upper policy.
Q. I heard that 'Channel' has been changed to 'Integration System'. Can I still use the existing integration method?
Yes, it can be used as is.
The terms have been changed from 'Channel → Integration System', 'Channel Code → Integration System Name', 'Business Code → Label', but the existing method of de-identification requests using Channel Code + Business Code continues to function unchanged.
There is no need to modify the request code of the existing integrated system, and the API Key issued additionally upon registration can be used optionally.
Q. How is the original file stored?
The original file before sanitization and the file after sanitization.AESIt is stored encrypted.
In the event of a security incident, it can be used for cause analysis and reprocessing, and you can check or reprocess it through the backup file download function.
You can set up a data organization schedule to manage retention periods and operate storage space efficiently.
Q. How is access control managed?
The web console provides multi-layered control.
- IP-based Access Control (Whitelist)— Access to the admin console is only possible from registered IPs.
- Login Failure Limit— Automatic account lock on consecutive login failures (choose automatic release / permanent lock policy). Blocks brute force attempts within the whitelist.
- Admin Enable/Disable— The administrator can temporarily block or re-allow usage on an account basis. Login attempts for inactive accounts are immediately denied.
- Session Automatic Logout— If unused for a certain period or if logged in multiple times with the same account, the session will automatically terminate. It prevents abandoned sessions and account sharing after login.
API is managed through system-based access control.
You can register the integration system and set access control rules that allow defusing requests, and issue an API Key for each integration system for identification.
Q. Is there an audit log and reporting feature?
Yes, it is provided. You can view the audit logs for administrator actions (menu access, setting changes, etc.) in the [Log] > [Administrator Audit Log] menu andCSVYou can export in the format.
It also visualizes file influx patterns, risk distribution, and threat element detection status, providing them in the [Report] menu, and supplies the data necessary for creating security reports.
Risk levels are classified into 6 stages from 'Safe' to 'Tampering' and visualized, allowing you to check the representative content types and counts for each risk level.
Q. Is it possible to integrate with the existing system?
Yes, it is possible. It provides a standard REST API that can flexibly integrate with various systems such as web gateways, cloud storage, email gateways, and more.
API guide and sample code are provided for quick integration.
It supports asynchronous processing methods, allowing for efficient integration even when handling large files.