Entitlement and Compliance Management

Top 10 Signs Your Homegrown Licensing is Broken

By Cris Wendt and Ram Visvanathan

If David Letterman did a "Top 10 Signs Your Homegrown Licensing is Broken" it might go something like this…

1. Your CTO says to his team, "run, Forrest run" when you ask him to make changes to the license key generator
2. Your celebrity CEO is asked to sign a pirate copy of your software on a trip to China
3. Your LinkedIn request to hire someone who knows Cobol gets 0 hits
4. Your CFO ends up in Brazil after appearing on the cover of the Wall Street Journal for missing quarter end revenue
5. You realize that the latest spam email from Nigeria has a master key for your software
6. You only sell one copy of the software to China and your sales team says that the market is saturated
7. Customers are completely happy with a non-expiring trial version of your software
8. Your business is in an HBR Story "The paradox of 100% of the customers having your new software, but the renewal rate is only 10%"
9. Your Oracle R12 migration costs exceed the GNP of most countries
10. No one in your organization has ever heard of Flexera Software

What is in your top 10 list?

All kidding aside, if any of the Top 10 ring a little too close to home – our proven and scalable software licensing, entitlement management and software delivery and update solutions can help.

Prevent Software Piracy and Hacking and Your Sales in China Could Increase by 127%

By Mathieu Baissac and Ken Hilker

In 2011, Flexera Software really tightened tampering prevention in our InstallShield 2011 and InstallShield 2012 releases (shipped Feb 2011 and Aug 2011) as we had found cracked versions of InstallShield 2010 on sites in China and Russia.

Financial Impact
Based on our estimates, we suspect that around 1,000 units of the cracked InstallShield 2010 were illegally downloaded; worth around $2 million USD (license only, assuming list price).

After applying FlexNet Publisher's Tamper Resistance, InstallShield units shipped to China increased by 127% year over year in 2012, breaking away from the previous year's decline in this region.

Takeaways

• InstallShield is a great product. Many developers want it, not all of them want to pay for it. This is a reality that many other software producers experience when bringing their products into new markets
• Hacks have quantifiable financial impacts.
  • Often we hear "those hackers wouldn't necessarily buy it, and that we should think of hacked copies as a marketing lead" (to paraphrase Bill Gates) but if you enter a new market with this mindset, the market will be built expecting to get your software for free.
  • The appearance of cracked versions of our software led to a decline in sales throughout the market. Applying tamper resistance led to a growth in sales for that market.
  • Although Flexera did not see a $2M increase in revenue by adding tamper resistance, we estimate 25-50% of that coming back
•  FlexNet Publisher's Tamper Resistance works.
  • InstallShield Uses Tamper Resistant Software Licensing Code to Prevent Piracy and Hacking

Funny Frustration Blogs from Hacking Sites
Just to give you a sense of the hacking, here are some sample posts from various hacking blogs:

Feb 2011—after InstallShield 2011 was shipped (with some tamper resistance)

• What's the status on the IS 2011 crack? English please
• IS 2011 could create new projects, but uhm... it would crash when build it…  who can help me ?????!!!
• Please post your current crack, so I or someone else can try getting it to work
• Cracking the crack cannot be downloaded, can you send to <email address>, thanks
• <Hacker> I am still working on it. the new protection is very different than the old one.

 June 2011

• Really needed this, looking for a long time
• Urgently needed
• How can I still cannot use it? Error message is as follows, <hacker name>, may I ask how to solve?
• Several were also hoodwinked several times, hope this is true

 Oct 2011

• <Hacker>2012 crack is said to be under development, looking forward to
• Wait for the leader of 2012
• 2012 have not come out, 2011 you did nothing,
• Try this, I have try a another crack for IS12, but it is invalid

 50 pages later….  Jan 2013

• Much-needed InstallShield 2012 break, come on ... ...
• Good, now do not expect the 2012 Edition can break, thanks for hard work
• Need the good things. See if you can.
• <Hacker> I am still working on it

Optimizing Software Revenue and Customer Satisfaction with Software License Compliance Management—Part 1

By Randy Littleson

Over the next several weeks I will be posting a series of blogs on software license compliance management, including:

Part 1 – Why Software License Compliance Management Matters
Part 2 – Pros and Cons of Traditional Compliance Management Approaches
Part 3 – Impact of Technology on Compliance Management
Part 4 – The Increasing Complexity of Software Licensing
Part 5 – The Growing Trend towards a Trust but Verify Compliance Management Approach
Part 6 – Revenue, Trust, and the Customer Experience

Part 1 – Why Software License Compliance Management Matters

In 2011 IDC pegged the global packaged software market at $325 billion. At the same time, the 2011 BSA Global Software Piracy Study found well over half of the world's personal computer users—57 percent—admitted they pirate software. In fact, the commercial value of pirated software climbed from $58.8 billion in 2010 to $63.4 billion in 2011. Clearly application producers have a lot at stake when it comes to software license compliance management.

Business Relationships Depend on Trust between Buyers and Sellers
The software industry has historically struggled with trust as it relates to the exchange of fair value. Many enterprise companies find themselves with unintentional overuse despite their desires and best intentions to avoid it. Regardless of the reason, piracy or unintentional overuse of software costs application producers billions of dollars annually. It's also a problem for corporate users who need to comply with contract terms as a matter of business ethics and compliance with corporate governance guidelines.

Selling and Monetizing Software with Licensing

Application producers provide the customer with an application based on an understanding of how the customer will be entitled to use that product across the organization. Application producers typically enforce how the product will be used with a licensing model that protects and monetizes their IP. Over time and depending on the markets and segments the producer serves, the producer may adapt a different licensing model based on changing customer needs or they may choose to adopt multiple licensing models.

Getting Software License Compliance Management Right Is Difficult
The reality is that those companies that get compliance management right are able to optimize revenues while delivering an even better experience to their customers. And those that don't, risk losing revenue and alienating their customers in the process.

Next Time:  Part 2 – Pros and Cons of Traditional Compliance Management Approaches

Related articles

Organizations Facing Increased Cost & Risk Exposure Software License Compliance Audits

Consumerization of Industrial Technology

By Bashyam Anant

Consumerization of IT is a recent phenomenon where enterprise IT departments are beginning to allow employees to access corporate applications from personal devices such as iPhones and iPads. In similar spirit, we are beginning to see consumer devices, in particular, smartphones like the iPhone, transform the way industrial technology is deployed and used. In this post, we will disscuss examples from medical devices and point-of-sale systems that illustrate the trend and the issues they pose for incumbents and new entrants in these markets.

In the medical equipment business, startups like Alivecor and CellScope are transforming smartphones into mobile diagnostic tools. Alivecor's heart monitor, for example, consists of a sensor, an iPhone app and a cloud-based application. The sensor snaps on to an iPhone (watch demo) and is placed on the patient. It then transmits heart signals to the iPhone app, which then transmits the data to the cloud application for associating the reading with the patient's medical record, for analysis or for printing an ECG. At this time, the device is commercially available as a veterinary heart monitor, pending FDA approval for humans.

Figure 1: Alivecor iPhone App for Heart Monitoring

CellScope uses optical attachments to turn smartphones into "diagnostic-quality imaging systems for healthcare, consumer skincare and education". One of their apps is a clip-on otoscope which helps pediatricians or parents take pictures of a child's middle ear and store or share the pictures, enabling ear infections to be diagnosed and treated remotely, all by using just a smartphone with an optical attachment and an associated app.

Square has transformed point-of-sale systems by following a similar pattern. Square allows a business to accept credit card payments using a card reader that plugs into a smartphone's headphone jack. Square's android or iPhone app then transmits the payment to the business' cash register in the cloud for reconciliation and analysis.

Alivecor, CellScope and Square are disrupting incumbents in their markets by disaggregating the value of industrial equipment (e.g. ECG monitors or point of sale systems) into sensors (e.g. card reader or heart sensor), smartphones and software. Incumbents that sell proprietary hardware devices in these markets are at a cost disadvantage (since they have to produce hardware while new entrants require only a smartphone) and will also be perceived as locking customers into proprietary hardware.

Because the new entrants make money on software and/or transactions, they now have to worry about protecting their IP against software piracy, managing the software lifecycle associated with their apps (e.g. software delivery and software updates), managing customer software entitlements (since each customer might have different rights to the software) and tracking and charging for usage, if they make money on transactions. Read these related posts for information on these topics:

Intelligent Hardware Manufacturers That Successfully Release Their Inner Software

Software Defined Data Center – Step Towards Utility-Based Business Models

The Internet of Things and Machine-to-Machine are on the Horizon—Are you Ready?

Share your stories of industrial use cases being transformed by smartphones.

Software Licensing Strategies to Address Cloud Computing License Abuse Challenges

By Bashyam Anant

In a recent CloudTimes article they ask, “Can Cloud Computing Stop Software Piracy?” The answer really depends on who runs the software in the cloud and how publishers in that context make money, as we discuss below.

The article points to a Business Software Alliance (BSA) study that found that “42% of users admitted to sharing their login credentials to paid cloud computing services with other people”.  SaaS publishers that we serve have reported similar levels of abuse. The article highlights that even though the SaaS publisher operates and remains in control of the application in this context, they still might be leaking revenues to unlicensed software use. So, does credential sharing matter? Yes, if you happen to be among the 25% of SaaS publishers that employ a named-user licensing model[i].  In our experience, developing software license policies that allow a given user to access the software from a set of registered devices is an important strategy to minimize credential sharing abuse, as Salesforce.com[ii] and Netflix.com[iii] exemplify.

What if you charged for a SaaS application based on a usage metric, as about 31% [iv] (up from 20% in 2010) of SaaS publishers do? While the CloudTimes article does not discuss it, unlicensed software use in this context refers to scenarios in which enterprises consume more than what they agreed to pay for. For example, for one Flexera Software SaaS application (we have been a SaaS publisher since 1996) where we charge based on the number of unique machines managed by the application during a license term, we have found that about 12% of customers exceed their unique machine quota. Clearly, if you charge based on a usage metric, you need a way to track usage, compare them to entitlements and use this data to drive compliance conversations.  

CloudTimes also mentions the notion of “dark clouds” – where an unauthorized party obtains a copy of the publisher’s software, deploys it in the cloud and either uses it or charges for it. Some publishers we serve have shared anecdotes where they have found instances of dark clouds running their software. For example, an intelligent device manufacturer that is pursuing a software-based strategy for telecom and networking products found that their virtual appliances had been downloaded from Amazon EC2 and deployed in another datacenter to drive an unauthorized business. This is indeed software piracy as is commonly understood. Software license enforcement solutions such as those from Flexera Software can be an effective weapon against this form of abuse.

Lastly, enterprises that deploy software in private clouds also run the risk of going out of compliance with the publisher’s software license terms. This is because virtualization technologies that are at the heart of private clouds make it very easy for an enterprise to clone software and over-deploy it. Microsoft has found that 11% of Windows Operating Systems that run as a guest operating system in a virtual environment are unlicensed[v]. In this setting, publishers and enterprises can and should look for a win-win – enterprises should be able to move virtual machines unfettered by software license enforcement while publishers should be able to monetize the value they deliver. Compliance management solutions that track usage of software in virtual environment and report it back to the publisher hold the key to ensuring a seamless experience for enterprises while protecting the interest of publishers.

In summary, while some members of BSA might believe that cloud applications will greatly minimize software piracy, we think the answer depends on the business and deployment model:

• Virtual private clouds greatly increase the likelihood of “piracy” through accidental overuse
• Credential sharing abuse is an issue and takes concerted efforts to minimize

What do you think?

---

[i] Source: Softletter SaaS Report 2010, http://www.softletter.com/Research/SoftletterSaaSReport.aspx

[ii] https://login.salesforce.com/help/doc/en/activating_computer.htm

[iii] https://signup.netflix.com/TermsOfUse#account

[iv] Source: Softletter SaaS Report 2012, http://www.softletter.com/Research/SoftletterSaaSReport.aspx

[v] Microsoft TechEd 2011

SoftSummit Regional Briefings—Register Now

Flexera Software is pleased to announce that registration is now open for the SoftSummit Regional Briefings. 

The SoftSummit Regional Briefings feature the interactive format, informative speakers and networking opportunities that are trademarks of SoftSummit—presented in a smaller, more intimate setting. This year, Flexera Software is offering the SoftSummit Regional Briefings in three locations: San Jose, California; Cambridge, Massachusetts; and Houston, Texas.

These events are free of charge, with sessions open to Flexera Software customers as well as prospective customers. But seating reservations are limited, so you must act now to secure a spot.

Briefings Schedule

Morning Session - 8:30 am to 12:00 pm
Flexera Software Customers and Prospective Customers
Breakfast will be served. Beverages and snacks will be available throughout the session

• Flexera Software State of the Union
• Discussion of major trends (cloud, SaaS, virtualization) and impacts to software licensing and entitlement management
• 2012 Key Trends in Software Licensing and Pricing Survey Results
• Customer case study and presentation
• Panel discussion with all presenters

Afternoon Session - 1:00 pm to 3:30 pm
Flexera Software Customers "Deep Dive" Session
Lunch will be served. Beverages and snacks will be available throughout the session

• Product roadmap discussions
• Customer feedback
• Product direction

Register Now for a SoftSummit Regional Briefing near you!

2012 Key Trends in Software Licensing and Pricing Survey Now Open

By Ann Reist

In its eighth year, the 2012 Key Trends in Software Licensing and Pricing Survey is now live. The survey, sponsored by Flexera Software and prepared with assistance from IDC, looks at software licensing, pricing, and compliance enforcement trends and best practices. The survey is open to all software vendors, intelligent device manufacturers, and enterprise customers who use and manage software and devices.

Key Findings from the 2011 Survey

• Revenue Generation and Customer Satisfaction Driving Changes: Forty-two percent of application producers indicate that they have changed their pricing and licensing policies over the past two years to make them more flexible. The top two reasons for this shift have been to improve customer relations (46%) and generate more revenue (40%). Accelerating the sales cycle (27%) was also cited as a key reason for broadening pricing and licensing policies.
• Software Budgets Starting to Increase: Forty-three percent of enterprises report that, looking ahead two years, they expect their software budgets to increase–up from 33% in 2010. Twenty-eight percent expect their budgets to stay the same, and 22% expect them to decrease.
• Moderated Approach to Adopting Cloud Licensing Strategies: Application producers are taking a gradual view in anticipating licensing strategy changes to accommodate the cloud. Forty-six percent indicate the changes they‘ll need to make will be moderate over the next two years. Thirty-four percent anticipate no change, while 21% indicate changes will be significant or dramatic.
• Tracking Customer Usage Remains Blind Spot for Application Producers: Of the application producers responding, the largest proportion, 47%, report that they do not monitor customer usage of their products. For those that do, 20% report doing so using internally developed tracking tools, and 16%, using manual audits. Only 10% use third party tracking tools.

Get the entire 2011 Key Trends in Software Licensing and Pricing Report

Don't miss your opportunity to take part in this year's survey! Emerging trends such as the cloud and virtualization are changing the way software vendors and intelligent device manufacturers must monetize, license and entitle their products in order to meet changing customer needs. These trends also impact how enterprises pay for and use software and intelligent devices.

The survey results will be presented by Amy Konary – Research Vice President, Software Licensing and Provisioning for IDC, at an upcoming webinar.

Be sure to weigh in on the 2012 survey so that your opinions are heard. All those who participate and provide contact information will receive an executive summary of the results and be entered into a drawing for an Apple iPad 3.

Take the survey now!

• Survey for software vendor & intelligent-device manufacturer professionals 
• Survey for enterprise professionals

Growing Number of Software Vendors Focusing on the Chinese Market

By Mathieu Baissac

I recently had the opportunity to sit down with one of our partners and they shared the following…

Between Jan-11 to Oct-11, the software industry (including intelligent device manufacturers) generated total revenue of 1.497 trillion Yuan ($237B), an increase of 32.9%; and export value grew by 14.9%. According to industry findings and predictions, China's software industry revenue will exceed 4 trillion Yuan ($635B), an average annual growth of over 25% and export value will exceed 60 billion Yuan ($9.5B). The Chinese government will also continue to introduce relevant policies to encourage the development of software companies. China's software industry will continue to maintain a steady growth trend over the next few years.

And, according to IDC – this market is very internally market-focused:

More than 90% of the ISVs develop software products for the Chinese market and the Chinese government is encouraging Chinese ISVs to export their developed software products overseas. It is expected by 2015 that the exportation rate will account approximately 10% of the whole software industry. (IDC 2010)

Recently, I’ve spent a fair amount of time traveling to China to talk to these producers (3-4 times in the last 2 months). During these visits, I would present “why do licensing” (the slide deck I would typically show in the US/EMEA) – and in China I usually got these reactions:

• using licensing to monetize features – blank or bored looks
• using licensing to identify customers, and customer use – blank or bored looks
• using licensing to control/sell upgrades – blank or bored looks
• using licensing to enable new capabilities in hardware – blank/semi-bored looks

And invariably – in the Q&A section, I would get grilled with the one question “how do we prevent customers from stealing our product.” And it wasn’t good enough to just say “oh-that’s what licensing is all about.” The questions would go into deep technical areas around “how do you prevent them from”:

• generating their own licenses
• removing the calls in the application that check for licenses
• playing with clocks to get trials to work for long time
• modifying the licenses so that they convert trial/termed to new dates
• making licenses and using on another machine
• etc.

These conversations reminded me so much of the conversations in the early to mid-1990s with US-based software producers.

China—welcome to Software Licensing! Learn more about our approach to Piracy in the following posts:

• The Hidden Truth about Application Security: There are No Shortcuts
• Tamper Resistant Code Helps Thwart Software Piracy
• Virtualization is the Biggest Game Changer in Software Licensing in Many Years

Rest of world: if that’s China’s #1 question and you want to sell your solutions into China or other similar countries – see these same links. You’ll need them for a while.

The Hidden Truth about Application Security: There are No Shortcuts

By Tu Le

I've worked in the security industry for over 15 years and I often get requests to help developers quickly integrate security protection into their applications. There are many piracy prevention solutions to lend a helping hand, including using software licensing and protection. Another option is to use executable packers and encryptors, which are often referred to as application shelling or hardening.

What is Application Shelling
Application shelling is a technology that a few software security companies offer to highlight how easy and effective it can be to protect software application intellectual property from being reverse engineered. As the name suggests, application shelling is a process where security functions are injected into the program and then encrypted based upon some industry standard such as AES (Advanced Encryption Standard).

Typically due to time constraints or in some cases, a lack of source code, the use of this technology is attractive to software publishers because it provides the ability to quickly get the product out the door. It also prevents novice crackers from modifying a few bytes of the executable to circumvent security such as the infamous "JNZ to JMP" instruction. However, there are hidden dangers in using this type of technology that most software publishers are not aware, including.

• When security fails, you end up with an unsatisfied, angry end user and usually a blue screen of death (BSOD)
  • Shelling involves injecting security function(s) and encrypting the program. When the security fails, the program will ultimately fail due to the program workflow getting redirected to some random memory pointer which will force the application to crash rather than gracefully exiting the program.
• Due to the encrypting and decrypting nature of cryptography, initial loading time will be impacted which will negatively affect the end user experience.
• Mission critical applications require a predictable outcome.
  • Since shelling technology enforces its own workflow in order to properly decrypt the program in memory, an unpredictable outcome results.
• Maintaining, troubleshooting and debugging a deployed application will be difficult as the application is encrypted.
  • Ironically, the company offering the application shelling will require an unprotected version of the application in order to troubleshoot.
• The application footprint will increase due to the nature of the technology as the process involves embedding additional security code to the application startup code sequence.
• A sophisticated hacker can exploit the shelling technology by embedding malicious malware into the application to circumvent virus and other security protection by masking its signatures to maliciously spread or gain access to an unauthorized area of the system.

Application Shelling Isn't the Panacea
There are other security mechanisms available, including software licensing technology that detects and limits the functionality of the program over time. This software licensing technology utilizes secure data types and tamper resistant applications to prevent software piracy and hacking. Implementing application security to minimize risk of software piracy requires careful planning and design.

Watch InstallShield Uses Tamper Resistant Software Licensing Code to Prevent Piracy and Hacking to learn more.

 

Maureen Polte, Vice President of Product Management for InstallShield

Virtualization is the Biggest Game Changer in Software Licensing in Many Years

By Mathieu Baissac

Some virtualization data points:

• In 2010, more software was run on virtual environments than on plain physical hosts (IDC)
• 65% of Enterprises want to virtualize their entire data center (Information Week, 2011)
• InstallShield saw a 132% growth in VMware use in 2011
• 11% of Enterprises said they did not track software in virtual machine (VM) environments (vs. 2.1% for non-VM software) (IDC 2011 survey)

In my years of talking to Publishers, this is the first time I've seen real fear when I start talking about VMs. They know (because they do this themselves) how easy it is to stand up a VM. As Los Alamos Lab IT proudly reports, in a self-service environment, their users can stand up a fully configured server in 30 minutes. Imagine that this VM image contains a license server pre-loaded with all the license files. It sure would be convenient, wouldn't it? So tempting, so easy, so … disastrous… from a licensing and compliance point of view.

If Publishers think they have 6-8% accidental software license over-use on plain old physical hosts, imagine the percentage change in the next 3-5 years as all those data centers get VMed.

What can Publishers and Enterprises do?  Here are some of the tactics that I've seen:

1. Get the VM vendors to come up with a standard, guaranteed to be unique, non-mutable and durable identifier – so licenses can be tied to these
2. Move to floating licenses and ensure that license servers aren't installed on VMs
3. Move to new licensing metrics (usage-based instead of per seat/device/user meters)
4. Move to hosted solutions where the Publisher has control over the license servers
5. Move back to dongles

Whatever the answer ultimately is, it's not "duck you head in the sand" – which seems to be the approach of many Publishers and Enterprises.

VMs are IT's best friend and License Manager's worse enemy.

What tactics are you using to protect against accidental software license over-use?