0

I just started a new software development company, We are using Windows Server, with Wamp installed on the machine. The machine is connected to a router and we have 10 employees. But only 5 of them are developers, the developers who have access to the machine are all on a network.

Our approach:

Every project is in a folder on the server for instance the Wamp Server, we create a folder for the project on the root directory of the server and thus the folder will be shared to everyone on the network so that the developers can work.

Problems:

  1. I want to be able to protect the folders on the server so that only the staff working on the particular project can have access to the folder.

  2. I want to be able to protect the folders so that the staff working on the folder cannot copy files from the server.

What would the best practices in this case be?

  • 2
    I write this as comment because it is not an full answer to the question, but as long as you can read file you can copy it. If your developers work inside office, you may disallow them to use USB sticks and CD's. If you want to be sure that the files from server will not leak by any of the users you may also disallow to use phones (so worker can not make picture of code), and don't provide them internet in working station (so files can not be sent through e.g. email). Question on uncopyable files: stackoverflow.com/questions/3362271/… – vakus Jul 29 '16 at 13:07
  • 1
    And you'll have pissed developers without access to stackexchange. If you don't trust the developers, why do you let them develop for you...? – vidarlo Sep 23 '17 at 18:44
  • Do you have an Active Directory domain set up? – Philipp Dec 23 '17 at 1:04
2

I just started a new software development company...we have 10 employees.

This implies you have a significant investment of capital. Yet, reading between the lines, there is a huge amount of risk and in efficiency in your setup.

Your code assets should be managed in a version control system. Build and deployment should be scripted. Your development and production environments should reside on different hardware.

Yes, you should be managing much more than just code artefacts - but a file share is a really bad place to store such design documents, test plans and bug reports. If your staff can't signpost you to better, free alternatives, then you are employing the wrong people.

I'm not saying you shouldn't have a file server, but not for sharing most of the development team's product.

I want to be able to protect the folders so that the staff working on the folder cannot copy files from the server.

This is simply not possible with the shared folder model. It is possible with a version control system but a very bad idea. Many people entering the business have an over-inflated opinion of the quality of their product and are convinced everyone is trying to steal it, including their own employees. You are unlikely to be in a position to be able to afford a truly effective IP management/DLP solution right now (and what you describe falls a very long way short). There are better ways to solve these problems.

0

First step is easy to solve: just use a RBAC policy. Members of group A can access application A, and members of group B can access application B.

About the second point, @vakus comment pretty much nailed it down. However, If you are just starting out and you have so much worries about employees leaking your product, you should really think if you are hiring the right people. Basically, you can't restrict that unless you have some very restricted environment that no one really wants to work in (people don't like to be monitored / restricted).

0
  1. You can easily do this via the windows permissions by allowing only groups access to certain folders and putting people in these specific groups. Things to help you tailor this more would be Active Directory and group policy.

  2. There absolutely are third party software solutions out there that provide this security. For instance, McAfee provides a product as part of their host based security solution called Data Loss Prevention that locks down end user systems peripherals and Access Control which kills certain people's ability from access and writing certain files and records who did what copying. So there are solutions, you usually just have to be willing to purchase third party software as Windows doesn't really come with a built in solution that easily accomplishes this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.