-1

I Want to setup a secure small business for game development, and was thinking of best way to secure content but still allow for people to develop. Of course, since development will take a few years, and anything can happen in that time, I want to be as paranoid as possible. Therefore we want something that protects against both intrusion AND extrusion, but still allows us to develop our UE3 game. Here are our challenges and requirements:

Have 5 people, are all at different locations, and only have around 35mbps down and up to work with for where we plan to place our network infrastructure.

Need to keep data secure in transit, secure on the server, and secure on the client.

Server-side at the bare minimum we need an SVN repo, internal webserver, internal mail server, and a VPN server.

Our budget is $1k - 1.5k, 2k only if absolutely necessary

All options I have considered include:

A Juniper SSG-5 network security appliance with AV and DPI licenses. Whatever sort of encrypted VPN setup the Juniper might support. A server with 5 clients. Virtualization (ESX/ESXi, CentOS + Xen, etc.) Full disk encryption for server and clients.

1st scenario:

Virtualize everything. Have everyone log in to a virtual machine hosted on a server at our location. Have a second physical machine that mirrors all of the VM's/acts as failover for redundancy.

Pros: All data is stored on the server this way, so it cannot be stolen from client computers, unless they possess a log-in to the server, which could be deactivated to prevent loss.

Cons: While Maya could potentially run and renders could be pushed to a farm, I do not think (correct me if I'm wrong) something like UE3 would run there due to terrible support as far as I know for 3D-intensive applications.

2nd scenario:

Let each person use SVN to upload/download assets or code to their own computer.

Pros: Most convenient way to develop.

Cons: No way to control where the data goes (anywhere on the internet? onto a flash drive or DVD to pass on to a competitor?) after it is client side.

The problem with these options is that the 1st one seems like it's just inadequate for developing a game, and the 2nd one is woefully insecure. What would you guys suggest for a secure setup and why?

1
  • 1
    You see your budget? yeah, times that by 50 and then you'll probably stand a chance. Also, who is John Madden?
    – tombull89
    Jun 20, 2011 at 8:09

2 Answers 2

5

Give up. Point. Your wishes, the reality and the budget dont match.

  • Unless you put up a really hard server farm, lot of bandwidth and use specialy Remote Desktop capabilities you dont get graphical intensive things running remote.
  • If you have 5 people on 5 loccations you dont have control over the content, regardless what you want or think.

You can easily put up decent VPN between people and a central site, but unless you force some sort of remote desktop use (and then you dont need VPN) you already lost control.

At the end of the day you have to trust people to not steal code or assets and otherwise take them to court.

Now, you could possibly set something up with central servers, lots of bandwidth - for a price of about 3000 USD+.... PER DEVELOPER (already at 15k). Will still not be perfect, but it would possibly "quite work". Sadly it is a total waste of funds and your.... budget does not allow it.

3

The big paranoid firms do this by forcing all work to be done within their secure physical perimeter. Once you have that, it's easier to filter all digital communications in and out of that perimeter. It takes a lot of effort to defend against things like cell-phone cameras, USB drives, and 3G network dongles, but it can be done.

Securing a remote workforce is also doable, but you do give up some of the control you gain by having all work done inside the secure perimeter. Screen-scraping by OS-based tools or cell-cams is nigh impossible to prevent. Graphics intensive development, such as that required by PC games development, is very hard to impossible to do over a remote connection (yet). Code under testing by the developer will have to share locality with the developer's test system, which inevitably takes it out of your secure perimeter. Extending the secure physical perimeter to the developer's remote environment is rather expensive (setting up a remote office with physical security, which kind of defeats the cost-savings of having a remote workforce).

Because code will have to share locality with developers, even if it is just compiled code, the compiled code will be vulnerable to leakage. I don't see a way around that without bringing all of your developers under one physical roof.

There are some things you can do to help minimize the chance of code going walkies:

  • Require all coding work to be done remotely Devs have to VPN in to code at all, and compiles happen centrally.
  • Require all VPN connections be done from a Company computer You don't want the Devs to connect their home systems to the VPN, just the company computers. One way to do this is to require Client Certificates for your VPN connection, and not make the certificates exportable.
  • Require HD encryption on storage that hosts compiled code It'll slow down performance, A LOT, but at least if the laptop gets stolen the compiled code won't wander about. Performance considerations might make this option non-viable.

And finally, keep in mind that onerous security causes creative people (devs) to get creative about working around it.

Not the answer you're looking for? Browse other questions tagged .