Home page logo
/

basics logo Security Basics mailing list archives

Re: Securing Development in a production environment
From: Ansgar -59cobalt- Wiechers <bugtraq () planetcobalt net>
Date: Fri, 31 Aug 2007 00:21:54 +0200

On 2007-08-30 Anthony Cogan wrote:
We have a number of issues over the past year where developers were
running FTP servers, anonymous file shares (with confidential data
and no ACL's) and other very insecure methods.

Their workstations are in the process of being replaced and are being
provided a locked down (least privilege user) environment.  A small
vocal group says they can not work this way and MUST have local
administrative rights to their box.

They're right. Developers should have local admin privileges on their
workstations. Their workstations, however, should be placed in a
separate network segment with NO access whatsoever to the production
network.

They have been provided virtual  machines running W2k03 Server joined
to our production domain (yeah, I said that right).

Bad idea. Really, REALLY bad idea. Don't do it. Developers should be
provided a testing environment that resembles your production
environment closely enough, but never EVER mix development and
production environment.

Regards
Ansgar Wiechers
-- 
"All vulnerabilities deserve a public fear period prior to patches
becoming available."
--Jason Coombs on Bugtraq


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]