Question

My boss have given me assignment to find how a web based application developed in .NET can be protected. As per agreement products developed in our company are an asset of the company and even non-developers can access the code. But my boss still he wants to know how he can protect products in case a developer steals the code and tries to launch it from his home ?

Please guide how this can be controlled.

Answer 1

If the developer has:

1. the source
2. the knowledge of how the the technical aspects of the system hang together
3. the knowledge of what the customers really want, beyond simple technical facilities

there isnt much you can do – things like Obfuscation and even Code Protection only kick in after a compiler has seen the code. Assuming you’re going to allow the developers to compile the full end-to-end code on their machine, it’s not hard to disable anything that one could ordinarily put in place to guard against customers stealing code.

Having said that, in the case of a web based application, you won’t be using something like Obfuscation as a first-line of defense mechanism – only as a (tinfoil-hatted) defence in depth mitigation against the threat of decompilation after someone has compromised your site and got themselves a copy of your assemblies.

Ultimately this is why protection around stuff like this is written in legalese, not a computer language.

(BTW this is a duplicate of this question which has some great answers – which I unfortunately only discovered after retagging this)