Since i use AHK in the corporate world professionally. I thought i might start a formal discussion on security issues in the corporate workplace. If particularly clever posts are made documenting a good security control i will link to it.
First lets start the discussion around issues i have had raised in corp security
- Residency- Scripts need to be seen as being altered only by authorised personnel. this introduces a number of control points.
- Version Control. only one production version can be used at a time
- Code Viewability. Script should not be stored within the native OS
- sensitive contents that may be inside the script such as passwords should be difficult to gleen
- developers should have to document changes to code and have it reviewed before being put into production.
- Access to scripts should be restricted to only the users that require it.
- Rogue scripts should be scanned for and removed
- Does not compromise existing security standards. Many corp environments require a desktop to lock automatically after a certain amount of inactivity. the scripts should not prevent or otherwise impede normal security controls.Data accessed from secure network locations should not be retrieved in mass and stored in incorrect locations by scripts
This thread will not endeavor to cover every security concern. I will update the OP as Items are discussed and solutioned. I intend to also post specific solutions that i may have used to mitigate issues. I welcome feedback from all skill levels but lets refrain from conversations about how open source means it should be freely available.