2

I am hiring few extra trainees who will use their personal laptop at my office to work on .net projects. I want to restrict the code/file access in their laptops with password. Like when they get in office ...they will ask me to type password to start work and when they leave office with their laptop ..i will ensure they "log off" so that cant access the code at their homes.

Improve this question
1
  • 6
    This does not stop them from copying the code to a folder you don't know about. Your idea is sort of silly. You are not going to be able to prevent them from copying the code if they are using a personal computer.
    – Ramhound
    May 23, 2012 at 11:56

4 Answers 4

Reset to default
2

A somewhat time consuming way to limit the ability to copy the code could be to set up virtual machines that the trainees have to remote access (and only from the office then). Only the remote machine has access to code/files and also Visual Studio.

The hardening that you probably need to solve for this scenario is to limit so files can't be copied of the virtual machine to the laptop accessing it and also limit so that files can't be uploaded to the internet.

When they complain that they need internet access to read msdn etc ask them to do that on their laptops, and have a way that you can move data for them to/from the virtual machines or a file server they can access from the virtual machines.

But this assumes you have the resources to run the virtual machines ... or another suggestion (that will cost a few monies) is to rent computers for them to use while on the company, that will get rid of the problem with them bringing their own, and also gives you more options with limiting user access.

Improve this answer
2

Typically in a high security environment removable media, laptops and even cell phones are prohibited. Employees are expected to work on their workstations provided by the company in the office and no where else. This is not a problem software can solve, it is a problem addressed with company policy.

If someone is bringing their own laptop there is virtually nothing you can do to keep them from making a copy of the code to a CD, DropBox account, or a million other methods of obtaining this information.

But there is a deeper problem. If you are able to prevent your employees of making a digital copy, they can still look at the code. Every day that they work they will understand it better and they could just implement it on their own. Its an issue of trust, and you have to trust your employees to some extent.

Improve this answer
9
  • can this help ? newsoftwares.net/folderlock/whatsnew and what truecrypt is about ?
    – sunny
    May 23, 2012 at 10:30
  • @sunny Nope, this does not address the threat you perceive.
    – rook
    May 23, 2012 at 10:35
  • ours is a product so if they see it no problem but should not be able to sell to my competitors as the IP laws in my country are not that mature yet. And trainee will take some time before he can be my competitor.
    – sunny
    May 23, 2012 at 10:36
  • 1
    @sunny - It does not take a great deal of work to install a keylogger on your personal computer, to capture the password you type in, without you knowing. Besides your idea still will not prevent the "copy and paste" to an unencrpted file. Unless you provide them with a computer you will be unable to protect your code.
    – Ramhound
    May 23, 2012 at 11:56
  • 1
    @Ramhound yeah you know whats up. Also hardware key-loggers are awesome. Clearly this is not a problem that can be solved in software, and companies usually address with policies.
    – rook
    May 23, 2012 at 17:04
0

Set the user accounts so they are only allowed to access the shared resources from the ip range you have in the office. It will not prevent them from making copies, but they will only be able to access the code/files from the office. They will still be able to make copies etc and since you say their laptops then it is hard to implement limits on the computer ...

Improve this answer
0

You cannot solve this problem with software or hardware, and it's going to be expensive / time consuming to even try. What you need to do is enforce this through policy. Here's how we do it:

  • Give each developer two machines and a USB stick. Two laptops, or a desktop + laptop will work fine. Connect one to the internet/email enabled network, connect the other to the developer network. Isolate the two networks completely. When they make a build, they can copy it onto the USB stick and transfer it to the other network, ready to go out for testing or release.
  • Have all developers sign a Non-Disclosure Agreement (NDA) that prohibits them from exporting source code and other company materials. This is enforceable via law.
  • Have all developers sign a policy document that explains what is allowed and what is not allowed, in terms of how they should handle source code and other sensitive documents. This is enforceable via disciplinary action within the company.
  • Set up the project to reference a release file containing the individual developer's name, so that any leaked builds can be traced.

The separation of duties between the laptops helps prevent accidental leaks, and acts as an indicator of intent should there be a leak. It makes it very difficult for an employee to claim that they accidentally leaked source files if they weren't supposed to have them on their internet-facing laptop in the first place.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .