NC1703

OPINION
SECURING SOFTWARE-
BASED IP
IF NOT SECURED AND
REGULATED SOFTWARE-
BASED INTELLECTUAL
PROPERTY CAN POSE A
SUBSTANTIAL RISK. SVEN ERIK
KNOP OF PERFORCE
SOFTWARE CONSIDERS WHAT
CAN BE DONE
The task of internally securing softwarebased
intellectual property (IP) and
confidential product data against the
insider threat is a major challenge for today's
organisations. Whether deliberate or
accidental, we are all aware of the catastrophic
damage that data breaches can cause. The IP
Commission Report estimates annual losses of
$300B attributed to insider IP theft in the
United States alone. Additionally, there is also a
growing need to protect software IP as part of
compliance requirements.
There are many aspects to managing internal
data breaches and one area that deserves a
bigger place in the spotlight is securing the
data source, namely the software development
process which, is inherently vulnerable. Product
teams tasked with creating software IP are
often globally dispersed with contractors and
external business partners collaborating on
multiple assets. These can include source
code, binary files, firmware, hardware designs,
images, art and video files. Often this data gets
stored in unsecured repositories with few
restrictions, leaving valuable IP vulnerable to
error or unwanted access. Here are four
measures that can improve protection of
software-based assets and IP.
CREATE A SINGLE SOURCE OF TRUTH
Having all participants check software assets in
and out of the same repository, with clear
visibility of everyone's actions, lays the
foundation for a transparent, collaborative and
auditable environment. A version control
system is typically used to create this single
source of truth, but there are a few things to
consider. Projects are increasingly dependent
on a wide range of assets and not just code, so
make sure that the system can support the
necessary file types. Also, the version control
system must be easily accessible, viewable and
understandable by users outside of the core
software development team, including external
auditors and compliance professionals.
Ideally, the version control system should be
capable of integrating with third-party security
tools to provide even more comprehensive
visibility of the enterprise's security landscape.
GREATER TRACEABILITY
This single source of truth should also provide
high-resolution visibility into who, when and
how critical IP is being accessed.
Administrators should be able to track every
system asset: what user accessed which file,
how, when and where and even why. Make
sure to use version control that provides an
immutable record so that users cannot amend
or delete changes.
IMPLEMENT FINE-GRAINED ACCESS
CONTROL
The type of access that users require varies
hugely according to individual roles. Granting
users unnecessary levels of access can increase
the risk of security vulnerabilities being created.
Protect critical IP with fine grained access
control using IP address, user and group,
enforceable at the repository, branch,
directory, or individual file level, locally and
across geographic regions and authorised
locations. As well as safeguarding valuable IP,
this rigorous approach to data access will also
help to address regulatory, audit and
compliance requirements.
A MORE COLLABORATIVE APPROACH
Some of the current trends in software
processes, notably DevOps, can also help to
protect IP, by creating a greater level of
transparency and interaction, making it more
difficult for security issues to be buried. This
brings us full-circle to the single source of truth
concept, which is increasingly being viewed as
integral to successful implementation of
DevOps by supporting a more collaborative
and accountable way of working.
Steps such as these are within the reach of
any organisation and can make a major
contribution toward securing the software on
which most enterprises increasingly depend.
Of course, addressing IP protection, the insider
threat, and other security risks is a multi-layered
endeavour and it is applicable to every stage
of each asset's lifetime. However implementing
more control around the genesis of those
assets is surely a logical starting point. NC
30 NETWORKcomputing MARCH/APRIL 2017 @NCMagAndAwards
WWW.NETWORKCOMPUTING.CO.UK