Re: Securing Development in a production environment
- From: Ansgar -59cobalt- Wiechers <bugtraq@xxxxxxxxxxxxxxxx>
- Date: Fri, 31 Aug 2007 00:21:54 +0200
On 2007-08-30 Anthony Cogan wrote:
We have a number of issues over the past year where developers were
running FTP servers, anonymous file shares (with confidential data
and no ACL's) and other very insecure methods.
Their workstations are in the process of being replaced and are being
provided a locked down (least privilege user) environment. A small
vocal group says they can not work this way and MUST have local
administrative rights to their box.
They're right. Developers should have local admin privileges on their
workstations. Their workstations, however, should be placed in a
separate network segment with NO access whatsoever to the production
network.
They have been provided virtual machines running W2k03 Server joined
to our production domain (yeah, I said that right).
Bad idea. Really, REALLY bad idea. Don't do it. Developers should be
provided a testing environment that resembles your production
environment closely enough, but never EVER mix development and
production environment.
Regards
Ansgar Wiechers
--
"All vulnerabilities deserve a public fear period prior to patches
becoming available."
--Jason Coombs on Bugtraq
- References:
- Securing Development in a production environment
- From: Anthony Cogan
- Securing Development in a production environment
- Prev by Date: RE: What is the best way to lock a local box on a network?
- Next by Date: RE: Question about Active Directory and last time user has logged on
- Previous by thread: Securing Development in a production environment
- Next by thread: Re: Securing Development in a production environment
- Index(es):
Relevant Pages
|
