EveryTag ILD - Information Leaks Detection

Information Leak Detection (ILD) is EuryTag's development system that identifies information leakage channels on paper media. It allows you to control the distribution of confidential data in paper form (audit results, test and research protocols, requests from regulators and inspection bodies, internal documents, financial information and much more). In the event of a leak, the solution will help detect the attacker.

The work is based on a patented marking algorithm (patent No. 2646341), which is used to automatically transform each copy of the document. If a leak is detected, the system helps easily identify the owner of the compromised copy from the photo of the document, the PC screen and the fragment of the document, regardless of the damage.

The ILD solution EveryTag introduced Unified register of Russian programs for in electronic computers and databases as a "Module for marking and detecting matching printed forms of documents" (reg. number ON 4464, Order dated Ministry of Digital Development, Communications and Mass Media of the Russian Federation 12.04.2018 No. 157).

ILD is addressed to banks, state-owned enterprises, insurance companies, financial organizations, industrial enterprises or extractive industries. The size of the customer company does not matter, the developers say.

2021

Compatibility with SED "Thesis"

The company "Holmont" March 25, 2021 reported that together with "EuryTag" conducted testing and confirm the correct operation of the SED THESIS and the system EveryTag Information Leaks Detection (EveryTag ILD). In more detail here

Overview of protection against leakage of confidential documents

In March 2021, a review of the means of protection against the leak of confidential documents from the company EveryTag was published. More details here.

2019: Integration into SED from Synthellect

EveryTag, a Russian developer of comprehensive solutions in the field of information security of the organization, together with Synthellect, a company engaged in the development of solutions in the field of document automation, on November 21, 2019 announced the implementation of a project in which [ILD (Information Leaks Detection) technology was integrated into the Tessa system. The shared solution allows its users to securely share documents and files containing sensitive information. More details here.

2018

Module for identification of matching printed forms of documents - in the Register of Russian Software

EuryTeg, a company specializing in the creation and supply of IT solutions in the field of corporate content management, on May 7, 2018 announced the inclusion of a module developed by it for marking and identifying matching printed forms of documents in the Register of Russian software. The module functionality is implemented in the ILD (Information Leaks Detection) system.

As explained in EuryTag, an algorithm for affinity transformations is used to mark restricted access documents. Thanks to him, employees who have access to a certain confidential document in the electronic document management system receive each of their own individual copies of the file with previously changed line and letter distances in it.

These transformations are not visible to the human eye, but are read by the system and allow you to save information about to whom, when and with what changes a personal copy was issued. The specified parameters in the event of a leak of the document will help employees of the company's information security service find out who became the culprit of the incident. The module will make it possible to accurately determine the source of the leak, even if only an excerpt of the document or its part containing blots gets into open access, HeurTag emphasized.

ILD can be built into both proprietary and free document management and enterprise content storage systems. The solution can also be connected to any enterprise user database that supports LDAP. This significantly expands the reach of companies potentially able to use the ILD solution, according to developers.

The module we developed is used not only to investigate leaks that have already occurred, but also to prevent them. Including a solution in the Register will allow us to more effectively offer a solution to state organizations for which the leak problem is no less serious than for business, "said Anton Samoilov, CEO of EuryTeg.

Patent for document identification mechanism

EuryTeg, a Russian developer of solutions in the field of information security and corporate content management, announced on April 16, 2018 the patenting of a mechanism that allows you to modify and identify documents to establish an unauthorized distribution channel. The method is used in the company's key product - the ILD (Information Leaks Detection) solution.

The company filed for patenting the mechanism in December 2016. Before issuing the patent, the Federal Intellectual Property Service (Rospatent) conducted a formal examination and examination on the merits of the patented invention. The received document ensures EuryTag the exclusive right to operate the IT solution.

The ILD system allows to find with 100% accuracy the culprit of leaking a restricted access document in electronic paper form on an individual copy issued to each employee. ILD is embedded in the company's electronic document management system and generates copies that are visually identical to the original for employees working with the document. At the same time, the solution stores information about who, at what time and with what kind of transformations received the personal version. If an unreliable employee prints a document, or takes a photo of it from a computer display to a smartphone and the file subsequently enters the public field, the organization's security service can easily determine who became the source of the leak.

At the same time, thanks to an optimized full-text search algorithm, the solution allows you to find a compromised document in minutes, even if a fragment of it is in the public domain. This feature reduces the time it takes company information security officers to investigate a leak.

Documents "merged" or lost by employees of companies penetrate the media space, and it is extremely important to protect organizations from possible financial and reputational damage from leaks. To solve this problem, we developed ILD. Obtaining a patent is a recognition of our expertise in the field of information security and confirmation that the system is credible to Russian companies for which the protection of their corporate information is important, "said Anton Samoilov, CEO of EuryTeg.

2017

Sample Document Identification Function

On September 6, 2017, EuryTag introduced the next version of the ILD system. The updated ILD (Information Leaks Detection) solution implements the function of identifying a document from a sample that has been publicly accessed.

In the event of a leak of confidential information due to the large amount of internal document flow, the security service may have difficulty finding the original of the compromised document. The updated solution helps determine which copy of which document was uploaded to the media or got to competitors, the companies said.

In addition, if a fragment of a multi-page document has leaked into the media space, the system, in addition to detecting the original file, helps to find exactly the page from which the published copy was made from the image. Enhanced functionality saves you the resources you need to investigate an incident.

We understand that in order to effectively combat leaks of confidential information on paper, companies need to provide a technological infrastructure that would automate the investigation of such cybercrime. Earlier, a mechanism was already introduced in the ILD system to help accurately identify the employee responsible for the incident. The proposed function provides the security services of Russian companies with even more opportunities in terms of searching for the original documents and analyzing the reasons why the leak occurred, "said Andrei Zaikin, technical director of EuryTeg.

The ILD security module is based on an affinity transformation mechanism that allows each employee working with an electronic copy of a paper document to receive their own individual version, which looks the same as the original version. The solution does not need to multiply or archive copies of documents in the electronic document management system. The ILD stores the conversion algorithm, the date and time of the copy creation, and information about the employee who received it. In the event of a leak, the system will "recognize" the document, even if it contains breaks, blots or if only part of it has been transferred.

Previously, a module was built into the solution that allows you to connect any user database that supports LDAP to the ILD. Information Leaks Detection is already integrated with a number of ECM platforms, including IBM FileNet, Nuxeo Platform, EMC Documentum, Directum, Alfresco.

Integration with Microsoft SharePoint

On August 22, EuryTag announced the integration of an ILD solution that controls confidential document leaks with the Microsoft SharePoint collaboration platform.

As a result, all the functions of the ILD paper document protection system have become available to companies using Microsoft SharePoint technologies. Ordinary users working with internal portals based on SharePoint will not notice any significant changes: collaboration in the team will remain the same convenient, while paper copies of documents will be properly protected, the company emphasized.

In addition to its own ILD protection methods, the integrated solution involves protecting electronic copies of confidential documents that users receive using Microsoft IRM (Information Rights Management) technology. The IRM system is designed for access rights management: a protected document is available only to the user for whom it is created, and only if the user is authenticated in the organization domain. The ILD system allows you to determine the owner of a paper copy of such a document in the event of a leak.

The Microsoft SharePoint platform is a convenient collective tool that allows a company to establish a smart intranet in which employees can interact with each other both from workstations and mobile devices. SharePoint capabilities make business processes more efficient, so hundreds of thousands of organizations around the world choose the platform. The integration of the ILD system with Microsoft SharePoint is a significant step towards the formation of a secure information environment for Russian companies, "said Andrei Zaikin, technical director of EuryTeg.

Olga Rusnak, Manager for the Development of Microsoft Information Office Systems in Russia, emphasized that "despite the almost universal use of digital technologies, paper-based documents still remain in demand in many companies. Our colleagues at EuryTag understand this and offer a solution that allows us to successfully investigate incidents related to leaks of confidential information on paper. We believe that the integration of ILD with Microsoft SharePoint marks the beginning of a long and productive collaboration in which technologies not only help to conduct joint projects in electronic format, but also stand guard over the security of confidential data in organizations.

Integration with Directum

The companies "EuryTag" and, Directum as part of a technology partnership, on August 17 announced the integration of the ILD (Information Leaks Detection) system with ECM the system. Directum The EuryTag solution is responsible for identifying leaks data channels on paper, and when unauthorized access to data helps to easily detect an attacker. Thanks to the integration mechanism, each time you access a confidential document, the ECM system creates a unique copy that, in the event of a leak, will allow you to set the date and specific user. Read more about the event. here

Integration with SED Logic

On August 8, Logic Business announced the integration of EuryTag's Information Leak Detection (ILD) solution into the Logic SED electronic document management system. ILD helps ensure that confidential information is leaked on paper. The algorithm of the solution is to create individual copies of the document with which employees work in the electronic document management system. ILD remembers several document parameters: the conversion algorithm, the date and time of the copy issue, as well as employee identification data. Thus, in the event of a leak of information, the ILD reliably determines the employee whose fault it occurred. Read more about technology integration here.

Open REST API

On July 5, 2017, EuryTag announced the release of the next version of the ILD (Information Leaks Detection) solution - a system for monitoring leaks of confidential documents.

The updated paper document protection solution implements a number of new features. In particular, the ILD system received an open REST API interface, which allows any developer to independently connect any one to the ILD. electronic document management system It expands possibilities of use of the decision: besides proprietary - ECM platforms (such as IBM FileNet P8 Platform EMC Documentum Directum , etc.), any free system of document flow can be connected to ILD and (data storage Nuxeo Alfresco and so forth).

The system also has the ability to connect any user database used in the organization and supporting the LDAP protocol.

The ILD system as a whole is an element of the company's information security system that allows you to reliably establish the source of confidential data leakage on paper media. The solution is designed to investigate the leak of confidential documents and can also be used to prevent leaks: for this, it is enough to launch a pseudo-document with important information into the electronic document management system and wait for it to appear in the media or from competitors, specified in EuryTag.

"Tracing the leak of paper documents is much more difficult than electronic - an unscrupulous employee can simply make a copy, carry it in a bag and continue to transfer or sell trade secrets to the company. In some companies, this has been happening for years. No system guarantees that the document will not "leak," but after the implementation of ILD, each employee understands that his actions will be disclosed. In our experience, this reduces the number of leaks to almost zero, "said Anton Samoilov, CEO of EuryTeg.

According to EuryTag, more than 20% of all leaks occur precisely through paper media: if digital data is protected by DLP (Data Leak Prevention) systems, then printed documents still remain vulnerable. In 54% of cases, it is their own employees who become sources of data leakage.

System operating principles

ILD is based on the principle of creating personalized copies of the original document. Each employee working with the document receives their own personal copy, which has microscopic visual differences from the original. To create these differences, the system uses an affine transformation algorithm. It randomly shifts lines and words relative to each other, resizes fields, adjusts line and character intervals. Visually, these changes are invisible, but for the system they form a unique "portrait" copy. As a result, each user receives their own unique document, which is assigned to it.

The ILD stores all transformation parameters. If an unauthorized copy of the document is detected on the Internet or the media, it is enough to upload it to the system and scan it. The program will automatically compare the modification parameters of the downloaded document with all copies that have been created and issued to employees or third parties. Based on the results of the comparison, the system will issue a match rating, which will indicate the assessment of the compliance of a copy with the downloaded file. The issue will indicate the name and other data of the employee - the owner of the copy, as well as the date and time of its receipt from the system, which will identify the attacker.

The system is able to determine the owner of the copy by the sample document in any form and state: it can be a photograph, screenshot, scan or screen photo. It will be possible to identify an unscrupulous employee even if the document is remembered, contaminated, corrupted or only a small fragment of it is available, EuryTag emphasized.

Technical features

The ILD electronic archive does not store the copies themselves, but only transformation algorithms, employee information and document issuance dates. Each generated copy is destroyed after some time: the deadline can be set independently (by default it is 9 hours). Digital casts of documents occupy 10-15 KB.

The system is not tied to proprietary platforms and integrates with most ECM-systems:, IBM FileNet,, Documentum, Directum "SED Logic" as well as - open source systems. ILD also acts as a stand-alone service with which you can work using the REST protocol (+ HTTP JSON).