I am hiring few extra trainees who will use their personal laptop at my office to work on .net projects. I want to restrict the code/file access in their laptops with password. Like when they get in office ...they will ask me to type password to start work and when they leave office with their laptop ..i will ensure they "log off" so that cant access the code at their homes.
A somewhat time consuming way to limit the ability to copy the code could be to set up virtual machines that the trainees have to remote access (and only from the office then). Only the remote machine has access to code/files and also Visual Studio.
The hardening that you probably need to solve for this scenario is to limit so files can't be copied of the virtual machine to the laptop accessing it and also limit so that files can't be uploaded to the internet.
When they complain that they need internet access to read msdn etc ask them to do that on their laptops, and have a way that you can move data for them to/from the virtual machines or a file server they can access from the virtual machines.
But this assumes you have the resources to run the virtual machines ... or another suggestion (that will cost a few monies) is to rent computers for them to use while on the company, that will get rid of the problem with them bringing their own, and also gives you more options with limiting user access.
Typically in a high security environment removable media, laptops and even cell phones are prohibited. Employees are expected to work on their workstations provided by the company in the office and no where else. This is not a problem software can solve, it is a problem addressed with company policy.
If someone is bringing their own laptop there is virtually nothing you can do to keep them from making a copy of the code to a CD, DropBox account, or a million other methods of obtaining this information.
But there is a deeper problem. If you are able to prevent your employees of making a digital copy, they can still look at the code. Every day that they work they will understand it better and they could just implement it on their own. Its an issue of trust, and you have to trust your employees to some extent.
Set the user accounts so they are only allowed to access the shared resources from the ip range you have in the office. It will not prevent them from making copies, but they will only be able to access the code/files from the office. They will still be able to make copies etc and since you say their laptops then it is hard to implement limits on the computer ...
You cannot solve this problem with software or hardware, and it's going to be expensive / time consuming to even try. What you need to do is enforce this through policy. Here's how we do it:
- Give each developer two machines and a USB stick. Two laptops, or a desktop + laptop will work fine. Connect one to the internet/email enabled network, connect the other to the developer network. Isolate the two networks completely. When they make a build, they can copy it onto the USB stick and transfer it to the other network, ready to go out for testing or release.
- Have all developers sign a Non-Disclosure Agreement (NDA) that prohibits them from exporting source code and other company materials. This is enforceable via law.
- Have all developers sign a policy document that explains what is allowed and what is not allowed, in terms of how they should handle source code and other sensitive documents. This is enforceable via disciplinary action within the company.
- Set up the project to reference a release file containing the individual developer's name, so that any leaked builds can be traced.
The separation of duties between the laptops helps prevent accidental leaks, and acts as an indicator of intent should there be a leak. It makes it very difficult for an employee to claim that they accidentally leaked source files if they weren't supposed to have them on their internet-facing laptop in the first place.