🔒 Locked

Game Developers: Have You Ever Been Treated Like a Corporate Cybersecurity Risk?

cybersecurity gaming simulation developer Behavior

Started by ZonalTycoon Jul 19 at 6:11 AM 2 replies 550+ views

Original Post

Jul 19 at 6:11 AM

This isn't an attack on cybersecurity. Every company needs good security. I'm genuinely curious whether other game developers have had similar experiences.

I sometimes wonder if many corporate cybersecurity policies are written with office software, web applications, and enterprise development in mind, without considering how different game development really is.

Game and simulation development is a very different discipline.

I've known simulation and game developers who went through intense vetting simply because they had legitimate development files, tools, SDKs, or assets that weren't on an approved list. Sometimes there wasn't even clear documentation explaining what was allowed or how to get approval. Instead, developers found themselves having to justify normal parts of their workflow and to defend even personal interests after being flagged. A few eventually left those companies and returned to studios where their work was better understood.

Access to information can also become a problem. Many websites are blocked simply because they're categorized as "gaming." But game developers don't visit those sites only to play games. We study gameplay mechanics, level design, UI patterns, AI behavior, balancing, animations, player feedback, technical articles, postmortems, and design discussions. Looking at existing games is part of learning the craft, just as filmmakers watch films, architects study buildings, and engineers study technical standards.

Then there's the day-to-day reality of development. We generate countless EXE files while building and testing. We install SDKs, drivers, graphics libraries, plugins, VR software, debugging tools, hardware utilities, and vendor software. We download EXE, MSI installers, DLLs, sample projects, open-source libraries, and small utilities to solve problems quickly. Some of the most useful development tools are decades old and still happen to be 32-bit. None of this is unusual. it's simply how game and simulation development works.

What becomes frustrating is when these completely normal game development and engineering activities are viewed without context. Instead of being recognized as part of a legitimate development workflow, they can sometimes be treated as suspicious. Developers end up spending more time explaining why they need a tool, a driver, an executable, or administrator access , USB access than actually writing code. For younger developers especially, it can feel intimidating when they don't have enough experience or influence to defend their workflow.

The irony is that many companies encourage innovation while their developers struggle to access the tools, references, and environments needed to build that innovation. Marketing teams are often encouraged to engage with external platforms and vendors, while development teams can face significant hurdles just to obtain legitimate development resources. One company I have known, had directed a simulation developer to format the computer immediately regardless of legitimate file and scanning proved to be all green, clear.

I believe cybersecurity should stop malicious activity. Not make legitimate software downloads, engineering unnecessarily difficult. The best security teams I've worked with understood the technology, documented their policies clearly, and collaborated with developers instead of assuming every exception was a security incident.

So I'm curious:

Have you ever been questioned for having "too many" EXE files?
Have legitimate tools, SDKs, drivers, or plugins been flagged in your workplace?
Have game development websites or reference material been blocked?
Have you struggled to get administrator rights or install software required for your work?
Do you think corporate cybersecurity policies adequately understand the realities of game development, graphics programming, simulation, XR, or embedded development?

I'd really like to hear experiences from game developers, technical artists, engine programmers, graphics programmers, simulation engineers, XR developers, and anyone else working in specialized software development.

Is this a common problem across the industry, or have I just encountered a few unusual environments?

frob

Jul 19 at 11:54 PM

Game studios control software to an extent mostly for legal and licensing reasons. Software audits are a thing, and license "true up" where the company is charged for computers with the software installed can be expensive. IT departments vary in how strict they are, but accountants and company lawyers make the policy clear.

For SDKs and libraries, software needs to be on the approved list. A rogue developer slipping in unapproved libraries, especially GPL or similar viral license libraries, is both termination worthy and also lawsuit worthy. A developer including an unlicensed library can completely destroy a commercial project.

In the corporate world, absolutely get permission before installing software on work machines. The company will have a policy of what is allowed without asking, what requires permission and documentation, and what is forbidden.

If you are installing your own copy of ZBrush or something, especially a student license on the work machine, it's just stupid. Tell them if you need it so they can get it properly licensed.

Game studios are usually pretty lax around game developers playing mainstream games, if you have Steam installed and play your personally owned games at lunch on company computers many companies are fine with that, but some are not. Usually the strict ones come with written contract terms, and they limit it on the machines usually because the company itself has signed agreements with others.

For hobby projects any library you use is at your own legal risk. If something is improperly licenced the lawsuit won't be affordable.

Emmanuel Deloget

Jul 24 at 5:56 PM

Speaking from the other side of the spectrum here - I am currently building cybersecurity solutions for companies.

There is a global misunderstanding of what cybersecurity is. Most people (and obviously, most managers as well) equates cybersecurity with "I need to protect myself from malicious software". While this is an important part of security, this is not the only one, and I would even argue that given the current state of affair, this is not even the most important (we do have many ways to protect ourselves from most malicious programs, to the point where it's not that common to be hit with a virus, unless you are installing your brand new LG gaming monitor of course).

The hardest (*) part in cybersecurity is tied to the human. It's all about policies and usage.

Even if you do not realize it, your usage might be a risk for your company (I am obviously using a generic you/your, I am not targeting anyone in particular). You may think that visiting this non-vetted web site is innocuous, but it may not - have you ever tried to check for the long-term reputation of this site before? (hint: you probably haven't, because you are pretty sure that it's safe ; ok, the ads are annoying and they are sometimes borderline, but the site, it's great !). You may think that this program is really helping you - but have you checked how it's built/distributed ? Popular softwares are often the target of malicious parties - I wouldn't be able to count the number of supply chain attacks that took place this year.

That's why we have policies, and that's why policies are an inconvenience : because we cannot protect the company from all human risks, the human is considered a risk as well and we restrict his possibilities using radical technical means. You cannot install whatever software you want because even if you think it's ok, it might not be. You cannot visit any site you want because it might not be as innocuous as it seems (and weirdly, gaming sites are often proposing non-hosted ads that are a bit scary from a security engineer). And because your company decided to limit risks, you are in a position where the mitigations affect you personally. This is not an ideal situation but in this very case, there is no ideal situation.

There is a path that would definitely help : tell your management that you require this tool to work efficiently (you can even tell them how much time you'll loose each day if you cannot use it). Tell them that you need to be able to visit these sites. I agree that the path itself is not ideal as well, but hopefully this will allow your management to get a better understanding of your needs as a game developper, while still allowing them to retain some control on your work environment.

PS: if you think game development has special needs, please consider mine : I sometimes need to download (and even install) viruses 🙂

BR,

-- Emmanuel Deloget

(*) hardest because whatever the technical means you put in place, users will manage to evade them - because they are inconvenient, because they know better, because they should be allowed to... and sometimes because they just do weird things that, for some reason unknown to any of the 3000+ gods that have been worshiped on Earth since the apparition of the human kind, happens to work for them.

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.