Employees uploading code to cloud disks: How to control data egress channels

Right before getting off work on Friday, the R&D supervisor found core algorithm source code uploaded to a public cloud disk. After investigation, it was uploaded by Wang, an employee who was about to resign. He connected his personal laptop to the R&D network and packaged the source files for exfiltration. Manufacturing plants and R&D enterprises fear insider data leakage most. Source code, engineering drawings and process parameters carry high value. Leakages usually happen through ordinary internet channels. It is not that hackers are exceptionally powerful; insiders themselves open the gate, and the outbound channel behind the gate is left unguarded.

1. Isolate the R&D network from the public network: Block the outbound path at the source

To govern data egress, the first step is isolation between the R&D network and the internet.
The R&D network hosts source repositories, design drawings and process documents, and should not have direct internet access. Under AINOPOL’s integrated connectivity-security solution, the R&D network is separated via VLAN segmentation and fully isolated from office and guest subnets. When staff need to search materials or send emails, they use controlled proxies or isolated breakout tunnels, so R&D data stays within the security domain.

Isolation prevents casual uploads. If R&D workstations cannot reach the public internet, employees cannot drag files into personal cloud disks. Any legitimate outbound transfer must go through an approval workflow, turning impulsive one-click uploads into formal auditable procedures. It supports necessary collaboration while greatly lowering the risk of unintentional leakage.

Isolation does not lock R&D teams out of basic internet resources. Instead, every cross-domain transfer is forced through a controlled checkpoint rather than direct desktop internet access. After the R&D network is fully separated from office and guest networks, compromised office endpoints cannot reach source repositories and process files, and lateral movement is blocked at the subnet boundary.

2. File permission control + activity audit: Trace all downloads and outbound transfers

Isolation blocks most risks, but malicious insiders may still abuse approved breakout channels. This calls for file permission control and comprehensive activity auditing. Files are granted access based on user roles. Core source code can be set to read-only without download permission, and drawings are accessible only to assigned project members. All download and outbound actions are logged completely: who initiated the transfer, the timestamp, the source terminal and the exact files sent. Every record is traceable.

This is not surveillance for intimidation. It creates a traceable lock for core digital assets. Once an incident occurs, administrators can quickly pinpoint the specific transfer event and terminal, instead of blindly scanning the whole network. Audit logs also serve as a management lever. Employees understand outbound behaviour is logged and monitored, discouraging careless leaks and risky “test uploads”.

Finer-grained permissions reduce the number of terminals that can touch core files, shrinking the potential attack surface.

3. Transmission encryption + real-time alerts for abnormal egress: The final safeguard

Even for approved outbound transfers, traffic must be encrypted to prevent interception in transit. More importantly, abnormal outbound behaviour triggers real-time alerts: bulk downloads within a short window, large file transfers outside working hours, or sending classified documents to unfamiliar cloud storage addresses. Security teams can intervene before files leave the secure domain.

The underlying control platform: Dream Gateway and centralized O&M
Built on all-optical infrastructure, powered by audio & video engine, and protected by robust security capabilities, AINOPOL delivers an integrated “connectivity & security” solution. The Dream Gateway handles network isolation and boundary defence. Paired with headquarters centralized management and unified O&M, it supports synchronized policy distribution, consolidated audit logs and alert linkage. For multi-building R&D sites, policies configured once take effect globally. Isolation, permission control, auditing and encryption are native capabilities on one unified platform, removing the need to integrate disjointed third-party security products. New R&D zones can reuse mature policy templates. Network administrators do not need to switch between separate security consoles. Policy updates are synced across the whole factory. Data egress control is designed from the ground up as a unified system, eliminating blind spots when new zones are added and preventing permission drift caused by staff turnover.

FAQ

Q: What if R&D staff need to look up reference materials temporarily?
A: Use controlled proxies or isolated breakout tunnels. R&D data remains confined inside the secure domain. Access rules are configured according to data classification and approval workflows, subject to site-specific deployment plans. Information retrieval is completed within the isolated channel, supporting normal work without allowing source code to leave the domain.

Q: Will activity auditing slow down R&D workstations?
A: Audit logs are aggregated on the gateway and management platform, bringing minimal overhead to endpoints. The actual performance impact depends on deployment scale. Audit granularity can be adjusted by project and role. Log collection runs on the gateway side to avoid consuming computing resources on R&D terminals.

Q: How to revoke outbound permissions for departing employees?
A: Accounts and associated permissions are automatically revoked together with the resignation workflow. R&D network access and file permissions are disabled synchronously. The exact revocation procedure is coordinated between HR and IT and recommended to be documented in the delivery agreement to avoid residual permissions.