Software protection - Bart De Win and Nessim Kisserli
Channel: secappdev.org
Date: 2015-08-20

Software protection techniques devised can be broadly categorised into pure-software solutions and hardware-assisted ones. While the hardware components used in software protection have undoubtedly evolved over the past few decades --helpfully converging on the usable USB dongle form-factor--, their use remains prohibitive for many software distributors for reasons of cost, inconvenience, user acceptance and so forth. However, as anyone with a basic understanding of computer architecture can attest, it is impossible to guarantee the integrity of software executing in a hostile environment in which the trust model is not built on underlying secure hardware. So the question is: which software-only techniques are, from a cost-protection perspective, sufficiently interesting to consider in practice?
In this session we provide an overview of software-only protection techniques, including those designed to guard against the unwanted analysis, copying, use, and tampering of software. Our goal is to discuss the strengths and weaknesses of each. We will then highlight functionally interchangeable components, and, where applicable, show how some of the techniques can be combined in a layered approach to achieve higher security claims overall.

This lecture was delivered by Bart De Win and Nessim Kisserli at SecAppDev 2015 in Leuven.

Bart De Win has over 15 years of experience in software security. He has an extensive background in the field, including his Ph.D. and research work on methods and techniques for software protection.  Since 2009, Bart has been responsible for all application security services within Ascure & PwC Belgium.  He has extensive project experience in software testing and in assisting companies improving their secure software development practices. 
Bart is member of the OWASP Belgium Chapter board and he is a co-leader of the OpenSAMM Software Assurance Model. Bart is SABSA, Prince 2 and CSSLP certified.

Nessim Kisserli  has over 15 years of experience in software security. He is a senior consultant at PwC.