News
Third-Party Perils
Analyst, firms warn that outsourcing development poses risk to
intellectual property.
Farming out pieces of an in-house app for development by third parties may make sense when time and money are short. But dev shops working with outside firms should take steps to protect the intellectual property contained in their code, security experts and vendors warn.
"The whole software outsourcing industry is seeing a pyramid scheme emerging in that the large outsourcing vendors would act as a general contractor and would outsource further to smaller vendors, and so on and so forth," Forrester Research Inc. analyst Chenxi Wang says. "Before you know it, your code is developed by someone who's sitting in his garage in the village of Bangalore."
Risk vs. Reward
Wang says she's only half joking.
The dilemma is that the developing countries where talented programmers work cheap generally are the same ones that pose the greatest risk of IP theft, says Vic DeMarines, vice president of products for software protection vendor V.i. Laboratories Inc.
DeMarines says customers often say they didn't define a formal IP protection strategy because they felt trapped between two extremes: "'Gee, we need to take advantage of this new China team to develop an app, so we need to provide them the full source code,' or, 'There's no way we're going to do outsourcing.'"
V.i. Labs' CodeArmor was originally designed to prevent reverse engineering of deployed apps. But a secure debugging encryption feature new to the recently released 2.0 version grew out of increasing concern from customers regarding outsourcing dev work or allowing partners to extend an app. It allows the team developing the software to grant appropriate code access to customers, partners or outsourcers through a password or digital certificate "without giving up all your intellectual property," DeMarines says.
Reducing Vulnerabilities
Wang says software developed on the .NET and Java platforms is especially vulnerable to reverse engineering, compared to traditional binary code written in C or C++. She recommends dev shops try to segregate the rest of the code base from the piece the third party is working on by providing only the relevant interface. She also suggests obfuscating code as much as possible.
"You may be able to expose only the API to the third party," she says. "This isn't always feasible, though."
Sebastian Holst, vice president of sales and marketing for obfuscation vendor PreEmptive Solutions LLC, maker of the Dotfuscator tool for .NET, stresses that dev shops also should insist that any third-party developers extending an app must obfuscate their finished work, too.
"What often happens is they may be less concerned about the binaries that contain your source code than you would be," he says. "By forcing them to obfuscate whenever they are done, it raises the bar for all the people they interact with."