Locking down individual developers to only the source they absolutely need. In that model, a single compromised workstation would only expose a few modules to

Locking down individual developers to only the source they absolutely need. In that model, a single compromised workstation would only expose a few modules to malicious changes and only a few projects to code theft. In the more-common wide-open implementation, a single compromised workstation exposes the entirety of code for every project to theft and malicious changes. When you're talking about an under-the-radar hack that took place over months, hackers intentionally slipping vulnerabilities into the code is a very real risk.