What assets am I trying to protect?
An unofficial pre-alpha software prototype provided as a reproducible example for evaluation during the scientific peer-review process. The software will be officially released under an MIT/BSD style license after it has been peer reviewed. The VM has been distributed through a ftp site and as a DVD.
The stakes are low: My gut feeling is that I don't want the unofficial version circulating in the future. I want the official version, with the capacity to update and cleaned of misc. artefacts to be used and not be confused with existing copies of the old version.
Even if I extend trust to peer-reviewers and colleagues, I would like to be able to share the software more informally without having to request that the file be deleted after the official version is released.
who uses the asset you're trying to protect, and who you think might want to abuse it (and why)?
Other scientists / potential employers / unwitting recipients who have not read the disclaimer could either scoop or falsely trust the draft version of our incredible and revolutionary software. The VM itself depends on code that is still under development and not intended for the first release of the software.
what steps you've already taken to protect that asset?
- I have a cron job set for July 1st, 2012 to run a script
cleanvm.shto remove files. I have used the virus tag because this seems to provide functionality I normally associate with viruses.
- Using the VM requires a password.
what risks do you think you still need to mitigate?
I would like to a) prohibit transfer of files outside of the VM and b) ensure that there is no simple workaround to disable the cron-job (changing system time comes to mind). Ideally I could set up a remote kill command that I could send prior to the official release , but that might be 'overkill' for the present context.