Simple and elegant in concept, Content Disarm and Reconstruction (CDR) also known as ‘file sanitization’,  is a breakthrough technology with superior results in the prevention of all file-based attacks, commonly used for Advanced Persistent Threats (APT’s), ransomware, zero-day’s and “traditional” virus attacks. 
It efficiently thwarts these attempts by dissecting every incoming file and enforcing a strict “known good” format, rather than attempting to detect embedded  malicious code by referencing the endlessly-evolving list of “known bad”. 
CDR compliments other anti-malware technologies like sandboxes and detection-based AV’s, but in contrast to them, it is a preemptive approach that does not rely solely on detection, and is consequently able to deliver exceptional levels of incident prevention.

A good CDR solution will feature both detection and disarm/reconstruction capabilities. During the CDR process, a file is broken-down to its most elementary components which are deeply scrutinized with multiple AV’s and cleansed from any embedded active code. The file is then rebuilt to its original vendor specifications – reassembled in a way that disrupts any possibly remaining, undetected malicious code. The end result is a completely new, yet functionally identical copy of the original file, delivered in real-time (see our ‘Before’ and ‘After’ CDR file samples page).

Highly configurable deconstruction/reconstruction controls also enable a surgical application of data redaction policies on the outgoing stream, for the implementation of data-loss prevention (DLP) and data-protection schemes.

Content Disarm and Reconstruction stages: