A Complete Guide to Content Disarm and Reconstruction (CDR)

Rather not read it now? You can view and download the full guide using the button below!

Have you ever heard of Content Disarm and Reconstruction, Content Disarm and Reconstruct, or CDR? If you have, you might recognize these are all terms used for a technology that can eliminate all file-borne threats. Keep reading as we provide an overview of what CDR is, how it’s used, the history and evolution of the technology, its pros and cons, and how a new technology — referred to as Positive Selection technology — takes CDR to the next level in both security and user experience.

What is Content Disarm and Reconstruction (CDR)?

So, what is CDR? Content Disarm and Reconstruction (CDR) is a security technology that — depending on the type of CDR involved — flattens malicious files (CDR Type 1), removes active content from the file (CDR Type 2), or cleanses malicious code from files without impacting the usability of the file (CDR Type 3).
 
Also known as file sanitization, CDR has multiple forms. In general, CDR does not need to rely on detection to prevent threats. Instead of relying on databases of known signatures, the technology assumes all files are malicious and scrutinizes all files that are outside of the approved firewall.

Depending on the type of CDR, which is explained in detail below, content disarm and reconstruction can remove malware, strips any embedded code, and rebuilds the file in a way that disrupts any additional covert malicious code.

The end result of using CDR technology is:

• A flattened file delivered as a safe but unfunctional PDF (CDR Type 1)
• A file with active content, macros, and other malicious and safe content removed (CDR Type 2)
• A safe copy of the original file on a clean template, with all functionality intact (CDR Type 3, Positive Selection technology)

Who is Content Disarm and Reconstruction technology meant for?

CDR is most often used to prevent file-borne cyber security threats from breaching an organization’s network. According to research, industries benefiting from CDR include banking, financial services and insurance, telecom and information technology (IT), manufacturing, construction, wholesale distribution, non-profit organizations, chemicals, food and beverage, retail, hospitality, government, public sector, health insurance and healthcare, among others.

Why is CDR technology needed?

File-borne threats are underestimated but highly risky. According to the Verizon Data Breach Investigation Report, the number 1 channel for enterprise malware delivery is Microsoft Office documents.

Let’s take a closer look at why it might be time for your organization to implement CDR technology:

Traditional defenses are no longer effective

Advanced threats are constantly evolving. Research indicates that an average of 10 million new malware threats are recorded per month. Many common cybersecurity technologies, such as anti-malware and anti-virus solution, can only detect known threats and cannot detect or protect corporate networks against undisclosed or zero-day attacks, meaning a vulnerability has been discovered but no patch for it has been developed. In fact, 80% of successful breaches are new or unknown zero-day attacks that are not recognized by traditional signature-based detection solutions.

Opportunities for cyber breaches abound

Today’s ever-increasing reliance on data brings with it elevated risks, threats, and vulnerabilities for organizations and communication networks, and many of these vulnerabilities are undetectable by traditional network security solutions. As the complexity of files increase, cybercriminals have more opportunities for exploits, increasing the need for CDR.

Sandboxes are not sufficiently effective

Despite widespread use, sandboxes struggle to keep up with the increasingly advanced techniques deployed by malware creators. Simple Google searches will provide attackers with the information they need to ensure their malware can evade detection within the sandbox – only executing once inside the production environment – or bypass the sandbox altogether. In addition, large file uploads can cause bottlenecks in the sandbox, and maintenance requires extensive IT resources, time and money, as well as the need to continuously update complex security policies.

Human error poses a risk

90% of data breaches are caused by human error. Despite organizational attempts to educate employees about the dangers of opening files from unknown or unreliable sources, clicking on suspicious links or downloading questionable files, 27% of employees in an organization fail phishing or social engineering attacks. This causes some organizations to restrict internet downloads or file attachments, despite the inconvenience and significant decrease in productivity. With CDR in place, you can reduce human error and regain productivity. 

Cost of breaches are increasing

Consequences of a malware attack are significant. Many companies suffer data loss, disruption of service, downtime, damage to the enterprise or organization’s reputation, and revenue loss. Accenture reports that the average cost of a malware attack on a company is $2.6 million, with the attacks costing the business an average of 50 days in lost time.

What does Content Disarm and Reconstruction help protect against?

With the increase in file-sharing – both between co-workers working remotely and between customers, partners, and vendors – enterprises face elevated risks, threats, and vulnerabilities from file-borne malware, and many of these vulnerabilities are undetectable by traditional network security solutions.

By design, an exploit targets a vulnerability in an application and typically triggers an intruder’s code. A vulnerability is a “hole” in an application—say, Adobe Reader—that can be exploited to launch an attack on a computer or network system. A common method used by attackers to exploit vulnerabilities is phishing or targeted spear-phishing: sending email messages that contain a malicious attachment and look harmless to the recipients. When a recipient opens the attachment, malware is deployed and the targeted attack begins.

To ensure a successful exploit, malware writers often carefully design and build multiple suspicious objects and embed them in a malicious complex file. For example, a Microsoft® Word file may contain an ActiveX® or OLE object to execute an attack, plus shellcode that is triggered by a malicious image or macro. (Shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability).

As these attacks become more aggressive, novel approaches to security are needed to successfully protect enterprises. CDR technology protects organizational networks from cyber threats that originate from multiple channels, including files from many sources, such as email, web browsers, file servers and FTP, the cloud, and computer endpoint devices.

Content Disarm and Reconstruction’s evolution over time

CDR – as most technologies – has advanced over time, improving its capabilities and enhancing any drawbacks. 

Here are the different types of CDR to be aware of:

CDR Type 1: Converting files to PDF

This type of CDR technology utilizes file conversion or transformation in order to render the file safe. The technology converts all files into a PDF file format, which eliminates the possibility of a hacker activating malicious code when a user clicks on a link or opens a document. However, it also creates a flattened document, without any legitimate macros, tracked changes, image transparency, form fields, layers, etc., effectively transforming the file into an unusable document and negatively affecting the organization’s productivity.

CDR Type 2: Stripping out active code and embedded objects

The next level of CDR technology aimed to improve on its earlier capabilities. It focuses on stripping out only certain types of content, such as embedded objects or potentially active content, in order to ensure the safety of each file. However, the file still loses functionality, such as links, essential macros, and business logic. It also overlooks a security risk by allowing fundamental, yet vulnerable, templates to remain within the document.

CDR Type 3 – Positive Selection technology: CDR evolved

The most advanced form of an evolved CDR, this technology focuses on template-based reconstruction that allows full preservation of features and full functionality. Positive Selection technology rebuilds the document, copying only the known-good, positively selected content and ensuring only the safe template elements remain.

What is Positive Selection Technology?

Votiro’s Positive Selection technology is the next evolution of the popular content disarm and reconstruction technology. Positive Selection uses template-based reconstruction to recreate clean templates with only the known good content included.

Unlike detection-based file security solutions that scan for suspicious elements and block some malicious files, Positive Selection singles out only the safe elements of each file, ensuring every file that enters your organization is 100% safe.

How is Positive Selection technology different than CDR?

While most types of CDR rely on malware detection, signatures, and predictive analysis, only Positive Selection technology delivers fully functional content in milliseconds that is always effective against zero-day attacks with a 0% false positive rate.