Security Basics mailing list archives
Re: Securing Development in a production environment
From: Ansgar -59cobalt- Wiechers <bugtraq () planetcobalt net>
Date: Fri, 31 Aug 2007 00:21:54 +0200
On 2007-08-30 Anthony Cogan wrote:
We have a number of issues over the past year where developers were running FTP servers, anonymous file shares (with confidential data and no ACL's) and other very insecure methods. Their workstations are in the process of being replaced and are being provided a locked down (least privilege user) environment. A small vocal group says they can not work this way and MUST have local administrative rights to their box.
They're right. Developers should have local admin privileges on their workstations. Their workstations, however, should be placed in a separate network segment with NO access whatsoever to the production network.
They have been provided virtual machines running W2k03 Server joined to our production domain (yeah, I said that right).
Bad idea. Really, REALLY bad idea. Don't do it. Developers should be provided a testing environment that resembles your production environment closely enough, but never EVER mix development and production environment. Regards Ansgar Wiechers -- "All vulnerabilities deserve a public fear period prior to patches becoming available." --Jason Coombs on Bugtraq
Current thread:
- Securing Development in a production environment Anthony Cogan (Aug 30)
- Re: Securing Development in a production environment Ansgar -59cobalt- Wiechers (Aug 31)
- Re: Securing Development in a production environment Goran Pizent (Aug 31)