mailing list archives
Re: Securing Development in a production environment
From: Ansgar -59cobalt- Wiechers <bugtraq () planetcobalt net>
Date: Fri, 31 Aug 2007 00:21:54 +0200
On 2007-08-30 Anthony Cogan wrote:
We have a number of issues over the past year where developers were
running FTP servers, anonymous file shares (with confidential data
and no ACL's) and other very insecure methods.
Their workstations are in the process of being replaced and are being
provided a locked down (least privilege user) environment. A small
vocal group says they can not work this way and MUST have local
administrative rights to their box.
They're right. Developers should have local admin privileges on their
workstations. Their workstations, however, should be placed in a
separate network segment with NO access whatsoever to the production
They have been provided virtual machines running W2k03 Server joined
to our production domain (yeah, I said that right).
Bad idea. Really, REALLY bad idea. Don't do it. Developers should be
provided a testing environment that resembles your production
environment closely enough, but never EVER mix development and
"All vulnerabilities deserve a public fear period prior to patches
--Jason Coombs on Bugtraq