Characteristics of anti-leakage requirements in the software R&D industry

Recently, I have been committed to the research and development of industry anti-leakage solutions, and to do source code encryption and anti-leakage solutions.
So far, I understand that many projects have been implemented. In summary, the industry has the following characteristics:
1. The level of software R&D personnel is relatively high, and it is not easy to do it first. 2.
The level of anti-monitoring, anti-encryption, and anti-leakage prevention of software R&D personnel is relatively high and difficult to prevent. Ordinary encryption products can easily be killed in seconds. People who want to spend time, process forging IP forging dll injection, etc., lazy people go to the next tool on the Internet, and they can basically do it. Not to mention those who understand security, I believe that 95% of the encryption products on the market can hardly survive 10 minutes;
3. Most employees will resist monitoring or encryption. Unless the company is strong enough, the money is issued enough, and the unit is good enough, it will be difficult to push forward. If the project is advanced, a balance point needs to be found; the

software development environment is also more complicated:
1. VC++ (MFC/ATL/COM/service) /Socket), JAVA (JSP/J2EE/J2SE/J2ME), PHP, C# (app/.net), protel, etc. If it is in the power industry or embedded, PLC industrial control, Android development, the development tools are even more strange . At this time, using traditional encryption products to solve the problem is basically a dead end, because so many process associations cannot be performed;
2. It cannot affect local debugging and compilation, especially network-related debugging or service debugging, and debugging of the simulator;
3 . , The server is mostly linux, and the client basically has a virtual machine;

there are generally three points in the use of behavior management:
1. It is necessary to give employees a certain amount of free space. For example, checking information on the Internet, QQ, etc., as long as it does not involve company secrets, he is still allowed to do it without monitoring. In this way, it is not easy for employees to be disgusted too much;
2. Safety and convenience are opposites, and it is necessary to grasp a balance point, it is impossible not to affect work efficiency at all, and if the influence is too severe, they will be disgusted, and it will not help the company;
3. There is no absolute security. The purpose of security is to increase the cost of leaking secrets, not to completely eliminate leaks. No one dares to pat their chests and say that their products have no problems at all. Even for a company as big as Microsoft, there are still bugs in their products;
4. When an anti-leakage solution is really needed, there must be a set of reasonable rules and regulations and a suitable security software, which can be used together and complement each other;

when selecting products, some conditions need to be met at the same time:
1. It does not affect compilation and debugging;
2 , Does not affect version management, version comparison;
3. Not just .cpp and other source code encryption, its appendages, obj, exe, etc. need to be controlled;
4. Can not destroy files;
5. The best source code documents are on the server The above is plain text, and it is cipher text on the employee's development machine, which reduces the dependence on encryption software and prevents security accidents;
6. It cannot affect the information on the Internet, QQ, etc., but it cannot cause leaks through this;